anti-phishing policy failed to flag credential-harvest domain

TL;DR

A brand-new harvest domain often has no reputation anywhere, so reputation-only policies miss it. The durable fix layers signals: add the domain and its variants to your tenant block list immediately, enable impersonation and lookalike checks for your protected brands, and make sure URL detonation follows to the final page where the credential form lives. Record the domain as an indicator so future campaigns using it are caught at the edge.

anti-phishing policy failed to flag credential-harvest domain

Use this when

• Users or a threat feed identified a credential-harvest domain that your filter delivered.
• The same harvest kit reappears under fresh domains weekly.

Not for this skill when

• The domain was blocked but a URL shortener hid it. That is a redirect resolution problem.
• The page is a legitimate site that was compromised. Blocking the whole domain needs more care.

Steps

1. Add the exact domain and confirmed subdomains to the tenant allow and block list as blocked, with the campaign reference noted. Verify: a test lookup shows the domain blocked for the tenant.
2. Check whether the message carried other signals the policy ignored: display name impersonation, a newly registered domain, or a mismatch between link text and target. Verify: each available signal and its policy state are listed.
3. Enable or tighten the anti-phishing settings that use those signals, including impersonation protection for your executives and brands and mailbox intelligence. Verify: the settings are on for the affected user group.
4. Confirm URL scanning follows redirects and detonates the landing page, not only the first hop. Verify: a controlled test URL chain is analysed to its final page.
5. Search mail flow for other messages linking the same domain and quarantine any found. Verify: the retrospective sweep reports zero remaining delivered copies.

Variant phrasings

tenant allow block list credential harvest domain

The immediate block variant.

anti phishing policy impersonation settings defender missed domain

The policy tuning variant.

Compatibility: Microsoft Defender anti-phishing policies and tenant allow block list, comparable controls in Proofpoint and Mimecast.

Why it happens

Credential-harvest domains are disposable: registered hours before the campaign and abandoned after. Reputation systems need reports to learn them, so the first wave through any filter is the hardest and must be caught by behaviour and impersonation signals instead.

Edge cases / pitfalls

• Submit the domain to the vendor and to public feeds after blocking locally; you help the next target and improve your own feed.
• Harvest kits reuse page assets. Hashes and page fingerprints catch re-hosted copies better than domains alone.
• Do not block a shared hosting domain at the root without checking what else lives there.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8-W-AXBU43NtgzU8VE0qJw