Anti-Phishing

Two Sides of Anti-Phishing

Anti-phishing operates on two fronts:

1. Defensive (inbound) — Protecting your organization's employees and systems from phishing attacks targeting them
2. Offensive (outbound) — Finding and removing phishing sites that impersonate your brand to attack your customers

Most anti-phishing discussion focuses on the defensive side. But for brands whose identity is being weaponized against their own customers, the offensive side — detection and takedown — is equally critical.

Defensive Anti-Phishing Technologies

Email Authentication Protocols

Three protocols work together to prevent email domain spoofing:

SPF (Sender Policy Framework) — A DNS TXT record that lists the IP addresses authorized to send email on behalf of a domain. When a receiving server gets an email from your domain, it checks whether the sending IP appears in your SPF record. If not, the email fails SPF verification.

DKIM (DomainKeys Identified Mail) — Adds a cryptographic signature to outgoing emails using a private key. The corresponding public key is published in DNS. Receiving servers use the public key to verify the signature, confirming the email wasn't altered in transit and was sent by an authorized system.

DMARC (Domain-based Message Authentication, Reporting and Conformance) — Builds on SPF and DKIM by telling receiving servers what to do when authentication fails: - none — Monitor only, deliver the email anyway - quarantine — Send suspicious emails to spam - reject — Block emails that fail authentication entirely

DMARC also provides reporting, so domain owners receive data about who is sending email using their domain — including unauthorized senders.

Browser and Gateway Protections

• Safe Browsing lists — Google Safe Browsing and Microsoft SmartScreen maintain lists of known phishing URLs. Browsers display warnings when users navigate to listed sites.
• Email security gateways — Products from Proofpoint, Mimecast, Microsoft Defender, and others analyze inbound email for phishing indicators before delivery to the inbox.
• URL analysis — Real-time scanning of links in emails and messages against known phishing databases and heuristic models.

User Training

Security awareness training programs (KnowBe4, Proofpoint, etc.) simulate phishing attacks against employees to build recognition skills. While valuable, training alone is insufficient — even well-trained users click phishing links at measurable rates.

Offensive Anti-Phishing: Detection and Takedown

For brands, anti-phishing also means finding and removing phishing sites that impersonate you:

Detection Methods

Domain monitoring — Watching for new domain registrations that contain or resemble the brand name. Data sources include ICANN CZDS zone files, WHOIS/RDAP records, and Certificate Transparency logs.

Web content monitoring — Crawling the web for pages that copy the brand's visual identity, login forms, or checkout flows. Uses visual similarity analysis, content fingerprinting, and logo detection.

Certificate Transparency monitoring — Watching for SSL certificates issued for brand-resembling domains. Provides near-real-time visibility into domains preparing to serve HTTPS content.

Threat intelligence feeds — Cross-referencing detected domains against known phishing indicators — blacklisted IPs, known bulletproof hosting providers, and malware distribution infrastructure.

Takedown Process

Once a phishing site is confirmed:

1. Evidence collection — Screenshot, WHOIS data, DNS records, content analysis
2. Multi-channel reporting: - Registrar abuse complaint (domain suspension) - Hosting provider complaint (content removal) - Google Safe Browsing report (browser warning) - Certificate authority report (certificate revocation)
3. Monitoring — Track whether the takedown is actioned and the site goes offline
4. Escalation — If initial channels don't act, escalate to upstream providers or law enforcement

The speed of this process determines how many customers are exposed to the phishing site. Manual processes take days. Automated systems can initiate takedowns within minutes of detection.

The Scale of Phishing

The APWG's Phishing Activity Trends Reports provide consistent quarterly data:

Quarter	Phishing Attacks Observed
Q1 2024	963,994
Q2 2025	1,130,393
Q3 2025	892,494

Key trends: - Attack volumes consistently exceed 800,000 per quarter since 2023 - 427 unique brands were targeted in Q3 2025 alone - QR code phishing ("quishing") is growing rapidly — Mimecast detected over 3 million unique malicious QR codes in the 12 months from Q2 2024 through Q3 2025 - Social media and messaging platforms are increasingly used as phishing delivery channels

Anti-Phishing for Brand Owners

For organizations whose brand is being impersonated in phishing attacks, the priority stack is:

1. Implement DMARC with reject policy — Prevents attackers from spoofing your exact email domain. This doesn't stop lookalike domain spoofing but eliminates exact-match spoofing.
2. Monitor for impersonation domains — Continuous scanning for domains that resemble your brand, especially those obtaining SSL certificates or setting up email infrastructure.
3. Automate takedowns — Connect detection to enforcement so phishing sites are reported for takedown within minutes of discovery, not days.
4. Track patterns — Identify repeat attack infrastructure (shared IPs, hosting providers, registrars) to anticipate and preempt future attacks.
5. Coordinate with threat intelligence — Share indicators of compromise with industry groups (like the APWG) and law enforcement to contribute to collective defense.