Sloppy phishing kits are still landing: what should defenders do?

TL;DR: A recent phishing wave combined obvious kit failures, including raw template variables, placeholder URLs and a Missouri typosquat, yet commercial gateways still delivered messages to inboxes, according to IRONSCALES. The lesson is that transport rules, URL parsing and DKIM checks are not enough when attackers can ship broken campaigns at scale, and human identity controls must assume low-effort abuse.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Best of the Worst: Five Attacks That Looked Broken (and Worked)”.

Key questions

Q: What breaks when phishing delivery exceptions override gateway detections?

A: When allowlists, transport rules or workflow exceptions override phishing detections, the organisation creates a privileged mail path that attackers can target.

Q: Why do lookalike domains and typosquats still fool users and filters?

A: They work because many controls score resemblance before they verify authority.

Q: What are the signs that a phishing kit is poorly built?

A: Common signs include unresolved template variables, placeholder URLs, inconsistent branding, encoding errors, and local-development references such as localhost or vm paths.

Practitioner guidance

• Audit mail allowlists and transport rules Identify every exception that can override spam, phishing or malicious-URL verdicts, then assign an owner and review cycle for each one.
• Detect kit artefacts in message body Flag unresolved template variables, placeholder URLs, localhost references, malformed encoding and inconsistent brand language inside the same email.
• Validate link destinations by registered domain Check the eTLD+1 and destination reputation, not the presence of a trusted brand inside the URL path or query string.

Bottom line: The article shows that even visibly broken phishing kits can reach users when mail controls prioritise delivery and workflow exceptions over deeper verification.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →