Detecting Phishing Landing Pages and Credential Harvesting

Whatever the delivery method, a credential-harvest campaign needs a page that imitates a known brand on infrastructure the attacker has just stood up. That produces a new domain, a fresh certificate and a login form that does not belong on that host. Those properties are visible in DNS, proxy, certificate-transparency and identity data.

Signals at a Glance

First Seen, Then Judge

A newly seen domain is common; a newly seen domain visited by several users after the same email is not. Combine first-seen age with a requirement for multiple users and a credential-themed referrer or subject:

// Sentinel / Defender (KQL) - domains first seen in the last 7 days and reached by several users
let history = DeviceNetworkEvents
| where Timestamp between (ago(60d) .. ago(7d))
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where isnotempty(Domain)
| distinct Domain;
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe")
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where isnotempty(Domain) and Domain !in (history)
| summarize users=dcount(InitiatingProcessAccountName), hits=count(), firstSeen=min(Timestamp) by Domain
| where users >= 3
| order by users desc
// tune/validate: pair with domain-age and reputation enrichment; new SaaS tenants produce many first-seen hosts

Brand Strings and Certificates

Attackers obtain certificates for lookalike names, and those issuances are public. Subscribe to certificate-transparency data and match your brand, product and login terms against newly issued names, using similarity rather than exact matches:

# Pseudocode for a certificate-transparency watcher (validate with your CT feed's schema)
BRANDS = ["contoso", "contoso-login", "contosobank"]
SUSPECT_WORDS = ["login", "signin", "verify", "secure", "sso", "portal", "account"]

for cert in ct_stream():
    for name in cert.all_domains:
        host = name.lower().lstrip("*.")
        if host.endswith(".contoso.com"):
            continue                       # your own domain
        brand_hit = any(similar(host, b) for b in BRANDS)   # edit distance or homoglyph fold
        word_hit  = any(w in host for w in SUSPECT_WORDS)
        if brand_hit and word_hit:
            queue_for_review(host, cert.issuer, cert.not_before)
# Output: reviewed hosts -> takedown request + proxy/DNS block + hunt for prior visits

• Check identity logs for the real damage: sign-ins following a visit to a flagged domain, token replay from a new IP and new MFA methods or inbox rules added afterwards.
• Prefer phishing-resistant authentication (FIDO2 or passkeys), which defeats a credential-harvest page that relays one-time codes.
• Submit confirmed pages for takedown with the registrar, hosting provider and browser safe-browsing services, and block the domain in DNS and proxy.
• Enrich flagged domains with age, certificate issuer and hosting ASN so analysts see the evidence beside the alert.