GoKawiilBlocklists were already losing ground before AI entered the picture. Phishing domains have been getting shorter-lived for years, campaigns have been burning infrastructure faster, and the gap between blocklists and attacker campaigns keeps getting wider. AI just finished the job.
Attackers are using AI to generate phishing pages from screenshots in minutes, spin up and tear down infrastructure faster than any blocklist can track, and iterate on tooling at a cadence that makes indicator-based detection functionally useless.
89% of phishing domains are now active for fewer than two days, with just 6.5% surviving past 15 days. By the time a domain makes it onto a blocklist, the campaign has moved on and the infrastructure has been replaced.
If your primary defense against attacks delivered via malicious webpages like AiTM phishing, device code phishing, ClickFix, file downloads, malvertising and more relies on matching known-bad indicators, you’re always two steps behind.
Disposable by design
The problem isn't just that phishing infrastructure rotates quickly. Modern attacks are designed to be disposable from the outset. Attackers aren't waiting to get caught and then pivoting. They're proactively tearing down pages and spinning up new ones to stay ahead of detection, treating each piece of infrastructure as single-use by default.
Attackers are also making that infrastructure harder to analyze while it's live, combining trusted hosting platforms — Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Adobe, Google Firebase, Google Sites, Jotform, Linode, Azure, Cloudflare, Atlassian, and many more are commonly abused — with bot protection, screening checks, and complex redirect chains on top to filter out researchers and automated scanners.
95% of in-browser attacks that Push Security detects use some form of bot protection, often layered with referrer checks and browser fingerprinting. The page a crawler sees and the page a real victim sees are frequently not the same page. And by the time you get to a once-malicious page (whether spun up by attackers or by compromising an existing site) the malicious payload may no longer be active.
AI has also collapsed the cost of creating the pages themselves, too. Attackers were already proficient at cloning pages, but they can now vibe-code entire phishing sites from a screenshot of a legitimate login page — a convincing frontend with a completely unique codebase that looks nothing like the real page it’s based on, and nothing for static analysis to fingerprint.
And phishing delivery increasingly abuses legitimate services — AI chatbot sharing features, search ad placement, in-app messages and app-generated emails — to inherit the domain reputation of platforms no blocklist would ever flag.
... continue reading