Outsider Enterprise Takedown: Analyzing the 'Million URL' PhaaS Infrastructure

We moved away from passive DNS blocklists about six months ago because of this exact issue. The latency is too high. We're now implementing real-time browser isolation for uncategorized sites. It adds a bit of user friction, but it completely neutralizes the dropper payload since the phishing page never renders on the endpoint.

From a pentester's perspective, the scary part isn't just the URLs, it's the obfuscation in the phishing kits themselves. I've seen similar kits using heavily minified JS that changes daily. If you're doing DFIR on the back-end, look for common base64 strings in the HTTP POST bodies—that's often where the exfil happens, even if the landing page looks different.

# Quick grep for base64 patterns in proxy logs
grep -Eio "(?:[A-Za-z0-9+/]{4}){10,}=" access.log | sort | uniq -c

The KQL query is solid, but be careful with the entropy threshold. I've seen legit SaaS platforms with high-entropy session IDs trigger false positives there. We added a filter to exclude known CDNs and cloud storage providers before checking entropy. That cut our alert fatigue by about 40%.

The shift to AI-generated domains makes reactive blocking impossible. We've had luck focusing on the server-side rather than the domain. Specifically, using JA3 fingerprints to cluster the hosting infrastructure.

Here is a quick snippet to extract and sort by frequency from Zeek logs:

cat ssl.log | awk '{print $9}' | sort | uniq -c | sort -rn | head

This often reveals the phishing kit's backend server IP regardless of the million front-end URLs. Has anyone else noticed if this group was using specific commercial hosting providers or just compromised VPS?

The volume is staggering, but Certificate Transparency logs are a solid proactive measure here. Since these sites need SSL certs to look legitimate, you can spot registration anomalies before the phishing kit is even deployed. We monitor for new certs containing high-entropy strings or suspicious TLDs registered in the last 24 hours.

ct-fetch --domain suspicious-keywords --since 24h

Has anyone else experimented with CT log monitoring as a primary source of truth for this type of PhaaS?

Building on the CT monitoring, we've added visual page fingerprinting to catch the ones that slip through. Since these kits clone legitimate login portals, we use headless browsers to capture screenshots and calculate perceptual hashes (pHash). This allows us to cluster attacks based on layout similarity rather than just code signatures.

Here is a quick snippet for generating the hash:

import imagehash
from PIL import Image
# Compare harvested pages against brand templates
phash = imagehash.phash(Image.open('screenshot.png'))

It’s surprisingly effective against AI-variations.