Phishing
An attack that impersonates a trusted sender (brand, coworker, service) to trick the victim into handing over credentials, card data, or access tokens.
Last updated:
What is phishing?
Phishing is a social-engineering attack in which the attacker sends a message that imitates a legitimate sender — a bank, a SaaS provider, an internal IT team, a shipping notice — and drives the recipient to a fake login page, a malware payload, or an urgent action like wiring money. The goal is almost always one of three: steal credentials, steal payment data, or plant malware. Email is the dominant channel, but SMS (smishing), voice calls (vishing), and chat-platform DMs are all common.
How phishing campaigns are run
Most bulk phishing runs follow the same pipeline: harvest target addresses (often via an email harvester or a leaked credential dump), spin up lookalike domains or abuse a compromised inbox, send from rented IP ranges, and land clicks on a credential-capture page hosted on throwaway infrastructure. Targeted variants — spear phishing (a named individual) and whaling (an executive) — use higher-quality pretext and reconnaissance, often pulled from LinkedIn and breach data.
Why IP reputation helps detect phishing
The sender IPs, link-destination IPs, and credential-capture hosts in a phishing kit tend to cluster on known-bad hosting ASNs and appear on multiple abuse feeds within hours of going live. Checking a suspicious sender or URL against an IP abuse report checker will often surface prior reports from other targets. Combining IP reputation with SPF/DKIM/DMARC email authentication and user-side link inspection catches the majority of bulk phishing before a credential is submitted.