--- title: How AI-powered phishing killed blocklists for good description: AI has made traditional blocklist-based phishing defenses structurally obsolete. Phishing domains now live fewer than two days on average, attackers use bot... canonical: https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How AI-powered phishing killed blocklists for good | daily.dev og:description: AI has made traditional blocklist-based phishing defenses structurally obsolete. Phishing domains now live fewer than two days on average, attackers use bot... og:url: https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh og:image: https://api.daily.dev/og/posts/gnxvYzTlH.png og:image:alt: How AI-powered phishing killed blocklists for good og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How AI-powered phishing killed blocklists for good **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 9 min read · 0 upvotes · 0 comments ## Summary AI has made traditional blocklist-based phishing defenses structurally obsolete. Phishing domains now live fewer than two days on average, attackers use bot protection and complex redirect chains to evade crawlers, and AI lets them generate unique phishing pages from screenshots in minutes. Even kit-level fingerprinting is eroding as phishing toolkits fragment through AI-assisted development and open-source sharing. The argument is that only technique-level behavioral detection — targeting the mechanics of attacks like AiTM, ClickFix, and device code phishing rather than their infrastructure — can survive this environment. Browser-session visibility is required since these attacks execute inside encrypted browser sessions invisible to network proxies and EDR. Push Security illustrates this with a real case where an OAuth redirect abuse technique was detected months later in a completely different campaign with zero IOC overlap, and claims its agentic threat hunting pipeline has blocked 225+ novel phishing instances across 60+ customers in three months. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How long do phishing domains typically stay active before attackers abandon them? Most phishing domains are extremely short-lived: 89% are active for fewer than two days, and only 6.5% survive past 15 days. This rapid rotation means that by the time a domain gets added to a blocklist, the campaign has already moved to new infrastructure, making blocklist-based detection largely ineffective. _Security teams tracking phishing trends can follow detection research like this on daily.dev._ ### What is device code phishing and how quickly has it spread among attackers? Device code phishing abuses the legitimate OAuth device code authorization flow, tricking a victim into approving a login code on a real identity provider page. It emerged in Russia-linked nation-state campaigns around 2024 and exploded into commodity criminal use by 2026, with 25+ distinct phishing kits now offering the capability, including EvilTokens, Kali365, and ARToken. _Anyone evaluating account-takeover risks can track how techniques like device code phishing evolve via daily.dev._ ### Why do security researchers say blocklists are no longer effective against phishing? Blocklists rely on matching known-bad domains, signatures, or tool fingerprints, but AI has let attackers generate unique phishing pages from screenshots, rapidly fork phishing kits, and abuse trusted hosting platforms like Cloudflare Workers and Vercel to inherit domain reputation. Because infrastructure and code are disposable by design, indicator-based detection is always steps behind; only technique-level behavioral detection survives rotation. _Teams reassessing their phishing defenses can keep up with detection strategy shifts through daily.dev._ ## Similar posts on daily.dev - [Artificial Intelligence-Driven Phishing: How Phishing Technique Is Evolving and Implemented](https://daily.dev/posts/artificial-intelligence-driven-phishing-how-phishing-technique-is-evolving-and-implemented-cebgsvxzz) · InfoQ · 0 upvotes · 0 comments - [How AI-Generated Content is Fueling Next-Gen Phishing and BEC Attacks: Detection and Defense Strategies](https://daily.dev/posts/how-ai-generated-content-is-fueling-next-gen-phishing-and-bec-attacks-detection-and-defense-strateg-hjbgtmbld) · Security Boulevard · 0 upvotes · 0 comments - [AI Phishing Is No. 1 With a Bullet for Cyberattackers](https://daily.dev/posts/ai-phishing-is-no-1-with-a-bullet-for-cyberattackers-jxd2wsge8) · Dark Reading · 1 upvotes · 0 comments - [Why the browser is now the front line for AI security](https://daily.dev/posts/why-the-browser-is-now-the-front-line-for-ai-security-w2bte7n9e) · BleepingComputer · 0 upvotes · 0 comments - [Most phishing now uses AI, says KnowBe4](https://daily.dev/posts/most-phishing-now-uses-ai-says-knowbe4-ugipftfqu) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How AI-powered phishing killed blocklists for good","url":"https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh"},"datePublished":"2026-08-05T14:13:48.436Z","dateModified":"2026-09-14T07:40:45.257Z","description":"AI has made traditional blocklist-based phishing defenses structurally obsolete. Phishing domains now live fewer than two days on average, attackers use bot...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b26c21d22d60c2c000ee91b5325c648?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b26c21d22d60c2c000ee91b5325c648?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"How AI-powered phishing killed blocklists for good"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh#faq","mainEntity":[{"@type":"Question","name":"How long do phishing domains typically stay active before attackers abandon them?","acceptedAnswer":{"@type":"Answer","text":"Most phishing domains are extremely short-lived: 89% are active for fewer than two days, and only 6.5% survive past 15 days. This rapid rotation means that by the time a domain gets added to a blocklist, the campaign has already moved to new infrastructure, making blocklist-based detection largely ineffective. Security teams tracking phishing trends can follow detection research like this on daily.dev."}},{"@type":"Question","name":"What is device code phishing and how quickly has it spread among attackers?","acceptedAnswer":{"@type":"Answer","text":"Device code phishing abuses the legitimate OAuth device code authorization flow, tricking a victim into approving a login code on a real identity provider page. It emerged in Russia-linked nation-state campaigns around 2024 and exploded into commodity criminal use by 2026, with 25+ distinct phishing kits now offering the capability, including EvilTokens, Kali365, and ARToken. Anyone evaluating account-takeover risks can track how techniques like device code phishing evolve via daily.dev."}},{"@type":"Question","name":"Why do security researchers say blocklists are no longer effective against phishing?","acceptedAnswer":{"@type":"Answer","text":"Blocklists rely on matching known-bad domains, signatures, or tool fingerprints, but AI has let attackers generate unique phishing pages from screenshots, rapidly fork phishing kits, and abuse trusted hosting platforms like Cloudflare Workers and Vercel to inherit domain reputation. Because infrastructure and code are disposable by design, indicator-based detection is always steps behind; only technique-level behavioral detection survives rotation. Teams reassessing their phishing defenses can keep up with detection strategy shifts through daily.dev."}}]} ```