This post is also available in:
עברית (Hebrew)
Phishing remains one of the most persistent cyber threats on the internet. Attackers continuously create fake websites, fraudulent login pages, and malicious links designed to steal credentials or distribute malware. Security teams often find themselves trapped in a reactive cycle: identify one malicious website, shut it down, and then discover that dozens more have already appeared elsewhere.
The problem is becoming even more difficult as cybercriminals adopt cloaking techniques that hide malicious content from automated scanners. Many traditional detection systems rely on analyzing website content directly, but if attackers conceal that content, security tools may never see the threat.
Researchers have developed a new approach that tackles the problem from a different angle. Instead of focusing on individual phishing URLs, the system attempts to identify and map entire phishing operations by analyzing the infrastructure behind them.
The platform, called PhishLumos, treats cloaking itself as a warning sign. When a website appears to be hiding information or presenting different content to different visitors, the system automatically launches a broader investigation.
Rather than examining page content alone, the platform analyzes technical infrastructure elements associated with the site. These include Internet Protocol (IP) addresses, network relationships, hosting connections, and other infrastructure indicators. Using this information, the system builds a knowledge graph that maps how different phishing websites, servers, and resources are connected.
This allows investigators to uncover entire phishing campaigns rather than discovering malicious websites one at a time.
According to TechXplore, in testing across 103 real-world phishing campaigns, the system identified malicious infrastructure an average of eight days earlier than human experts. During a six-month deployment, researchers began with approximately 600 known phishing URLs and used the resulting infrastructure analysis to uncover more than 190,000 additional links. According to the study, roughly 92 percent of those newly discovered URLs were later confirmed as malicious.
From a cybersecurity and defense perspective, infrastructure-focused detection represents a significant shift. Many cyber operations, whether criminal or state-sponsored, rely on large supporting ecosystems of servers, domains, and network resources. Mapping those relationships can provide a broader view of an adversary’s activity than analyzing isolated threats.
The research highlights a growing trend in cyber defense: moving from reactive detection toward campaign-level intelligence. Rather than simply removing individual phishing sites, systems like this aim to expose the underlying infrastructure that allows entire malicious operations to function.
The research was published here.
