Stop phishing at resolution
The domain is blocked before the page loads.
Every phishing attack starts with a lookup. Blocklists catch known domains. The Greywall holds the ones registered this morning.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 08:41:02 | accept | corp-office | login.microsoftonline.com | 10.1.5.40 | allow list |
| 2026-09-15 08:41:19 | greywall | corp-office | micros0ft-secure-login.com | 10.1.5.40 | first seen, rank 0 |
| 2026-09-15 08:41:19 | threat | corp-office | docs-share-verify.top | 10.1.5.40 | feed: phishing-urls |
| 2026-09-15 08:42:03 | block | corp-office | sso-reset-portal.info | 10.1.5.40 | category: parked |
The phishing domain is younger than your blocklist
Lookalike domains are registered hours before the email lands and abandoned hours after. A feed that learns about the domain tomorrow is a feed that missed it. The click resolves a name, and that is the moment to answer.
Lookalikes are new
A domain registered this morning has no reputation and no rank. First-seen is the only signal that exists in time.
Links open outside the mail client
QR codes, chat messages and documents deliver the same link past mail filtering.
The page is convincing
Users cannot be the control. The resolver answers before the page renders.
Three layers at the lookup
Feeds and categories
Known phishing domains from your feeds and the security categories are blocked on every policy.
Greywall for the unknown
A domain the policy has never resolved is held. Rank zero names stay held until reviewed.
Block page for the user
The user lands on your block page with the reason, instead of a login form that steals a credential.
Anti-phishing controls
Your feeds, enforced
Ingest phishing indicators in STIX, CSV, TXT or JSON on a schedule. Enforcement follows the next publish.
First-seen hold
Newly registered lookalikes are first-seen by definition. Held before anyone can enter a password.
Establishment rank
Rank zero in the log means the domain has no history anywhere. Prioritize the review.
Branded block page
Your logo, your wording, the reason. Users learn what a block looks like.
SOAR push
An analyst confirms a campaign and pushes the domain to the block list from the SOAR in one call.
Who clicked
Every held or blocked lookup carries the source address. The user who clicked is in the log before they report it.
From the SOAR to every policy in one call
A confirmed phishing domain goes into the block list with a confidence score, an expiry and the case reference, and is enforced everywhere on the next publish.
POST /api/v1/gateway/push/{list_uuid}/entries
Authorization: Bearer sk_... (scope: lists:write)
{ "entries": [
{ "value": "micros0ft-secure-login.com", "confidence": 95,
"expires_in": 604800, "source_ref": "IR-2291", "note": "credential harvest" }
] }Questions teams ask
Does this replace email security?
No. Mail filtering removes messages. Securd blocks the destination when a link is clicked from anywhere: mail, chat, a document, a QR code.
Will the Greywall hold legitimate new sites?
Yes, and the review queue shows them with the requesting site and rank. Approve once and the entry is permanent for that policy.
Can I see who clicked?
Every event carries the client address and site. Forward to the SIEM to join with your identity data.
Stop the next lookalike before it renders
One policy on the office network with the Greywall on. Review the queue after the next campaign.