---
title: 'PhishLumos: Adaptive Phishing Mitigation'
url: https://www.emergentmind.com/topics/phishlumos
type: topic
---

# PhishLumos: Adaptive Phishing Mitigation

Searching arXiv for the specified paper to ground the article in the cited source.
PhishLumos is an adaptive multi-agent system for proactive phishing campaign mitigation introduced in “PhishLumos: An Adaptive Multi-Agent System for Proactive Phishing Campaign Mitigation” [2509.21772]. It is designed for phishing attacks that use advanced evasion tactics such as cloaking, where phishing sites show benign content or errors to security scanners while attacking real users. The system shifts the defensive objective from reactive blocking of individual URLs to proactive disruption and mitigation of entire phishing campaigns before widespread harm occurs. Its operational premise is that evasive behavior is not merely a failure mode for detection, but a useful signal for investigating the underlying infrastructure through shared hosting, certificates, and domain registration patterns [2509.21772].

## 1. Threat model and defensive objective

Phishing attacks are described as a significant societal threat that disproportionately harms vulnerable populations and erodes trust in essential digital services. PhishLumos is positioned against a core cybersecurity imbalance: attackers can easily scale operations, while defense remains an intensive expert task. Within that framing, conventional defenses such as URL blocklists and content-based classifiers are characterized as reactive mechanisms that are effective only when attack content is accessible and are easily evaded by cloaking, CAPTCHAs, scanner blocking through 403/404 responses, or minimal content [2509.21772].

The system therefore treats phishing as a campaign-level problem rather than a URL-level problem. From a single suspicious URL, it aims to uncover hundreds or thousands of related pages or domains associated with the same campaign. This campaign-oriented emphasis is important because it changes the unit of mitigation: the goal is no longer only to identify an observed malicious page, but to derive campaign intelligence and detection rules that can support larger-scale mitigation before mass victimization.

The paper also distinguishes several campaign conditions through evidence indicators. A campaign may be characterized as **Confirmed** when there is brand or content detection together with shared infrastructure, **Cloaked** when there is a URL or final-destination mismatch, especially toward a benign destination, **Reuse** when there is shared infrastructure with prior malicious domains, **Unavailable** when error codes are observed but shared infrastructure links the site to a known campaign, and **Unclear** when evidence is insufficient. These categories define the evidentiary logic used in campaign linkage rather than a purely content-visible taxonomy.

## 2. Multi-agent architecture

PhishLumos is organized as a multi-agent architecture with modular collaboration and a stateful workflow. Coordination is handled by a central Supervisor Agent, while task-specific reasoning is delegated to specialized and synthesis agents. Each agent is powered by a Large Language Model and operates on focused inputs and outputs [2509.21772].

| Agent | Primary goal | Key inputs/outputs |
|---|---|---|
| Supervisor | Orchestrate overall workflow and analysis | Input: URL, Output: Final report |
| URL Analysis | Gather scan and status data for URL | Input: URL, Output: Scan history, brands |
| Domain Analysis | Investigate DNS/IP history | Input: Domain, Output: IP history, patterns |
| IP Analysis | Analyze domains and activities for an IP | Input: IP, Output: Linked domains, activity |
| Certificate Analysis | Analyze certificate use and patterns | Input: Domain, Output: Issuer, shared certs |
| Campaign Analysis | Profile synthesized campaign from evidence | Input: All data, Output: Campaign profile |
| Rule Generation | Generate and validate new detection rules | Input: Key indicators, Output: Search queries |

The architecture aggregates findings into a central Knowledge Base. This Knowledge Base is not a passive store; it is the substrate on which subsequent agent invocations depend. The Supervisor dynamically sequences tasks according to the evolving contents of the Knowledge Base and the investigation history, which makes the overall procedure adaptive and stateful rather than a fixed cascade.

At the agent level, the paper attributes several functions to the embedded LLMs: reasoning over incomplete and fragmented information, selecting pivots, generating hypotheses, synthesizing structured findings, evaluating context under prompt and context-length constraints through summarization and field extraction, generating detection rules, and empirically validating those rules to ensure high signal and low false-positive rates. In this design, LLMs are not confined to language generation; they are part of the decision layer that determines when to pivot, when to stop, and when to escalate to campaign analysis or rule generation.

## 3. Investigative control flow and adaptive pivoting

The operational workflow begins when the Supervisor Agent receives a suspicious URL and coordinates initial reconnaissance through the URL Analysis Agent. The Supervisor LLM then evaluates the findings and determines investigative pivots, for example toward IP, domain, or certificate analysis. Specialized agents return processed findings, which are added to the Knowledge Base. The Supervisor continues to sequence further tasks based on the evolving Knowledge Base and investigation history. After sufficient evidence has been gathered, the Campaign Analysis and Rule Generation agents synthesize a campaign profile, extract key indicators, and generate validated detection rules [2509.21772].

This procedure is summarized in the paper as a high-level LLM-powered control flow:

```latex
\begin{algorithmic}[1]
\STATE Input: URL $u_0$; Initialize Knowledge Base KB, History H
\STATE Task: (URLAnalysisAgent, $u_0$); Update KB, H with findings
\WHILE{InvestigationIsActive(KB, H)}
    \STATE action, params $\leftarrow$ LLM.DecideNextAction(KB, H)
    \IF{action == PIVOT\_TO\_INFRASTRUCTURE}
        \STATE agent, pivot\_data $\leftarrow$ params
        \STATE findings $\leftarrow$ ExecuteTask(agent, pivot\_data)
        \STATE Update KB, H
    \ELSIF{action == CAMPAIGN\_ANALYSIS}
        \STATE break
    \ELSE
        \STATE break
    \ENDIF
\ENDWHILE
\STATE campaign\_profile $\leftarrow$ CampaignAnalysisAgent(KB)
\IF{IsCampaignIdentified(campaign\_profile)}
    \STATE rules $\leftarrow$ RuleGenerationAgent(campaign\_profile)
    \STATE return (campaign\_profile, rules)
\ENDIF
\end{algorithmic}
```

The paper explicitly characterizes this process as knowledge-driven and dynamic. There is no fixed analysis cascade; the LLM chooses the best investigative pivots at each step. That property is especially relevant when phishing content is inaccessible or deliberately hidden, because a rigid pipeline would tend to terminate at the point where content retrieval fails. PhishLumos instead uses that failure condition as a branching signal.

## 4. Evasion handling, infrastructure linkage, and rule generation

A defining property of PhishLumos is that evasive behavior is treated as an investigative trigger rather than an obstacle. The paper lists several such triggers: scanners receiving 404 or 403 responses, CAPTCHAs, content mismatches, or redirection to benign URLs such as google.com. When these are detected, the system pivots to infrastructure artifacts such as IP, ASN, certificate, or whois and domain-registration patterns rather than abandoning analysis because content is inaccessible [2509.21772].

Campaign scope is inferred through multiple classes of shared evidence. The system analyzes shared IPs and hosting, especially on non-CDNs; shared certificate patterns, including reuse of TLS/SSL certificates or issuer characteristics across clusters of domains; domain registration patterns such as similar registration fields, registrars, or naming conventions including wildcards and regional TLDs; ASN-level aggregation when IP hopping makes address-level linkage unstable; and temporal correlations in which campaigns launch waves of similar domains over tight timeframes. These signals provide the basis for campaign linkage even when the phishing landing page itself is not directly observable.

The paper provides an illustrative scenario in which an input URL appears innocuous and shows no sign of phishing, yet IP analysis reveals that it shares an IP with a previously confirmed phishing URL, while certificate analysis shows both domains using the same generic, short-lived certificate. The Supervisor then aggregates the evidence and triggers Campaign Analysis, which profiles the activity as a “REUSE” campaign. This example demonstrates the system’s logic of inferring malicious campaign membership through shared infrastructure rather than page content alone.

Rule generation is presented as the actionable endpoint of the investigation. The paper gives a representative rule template:

$$
\text{If landing IP = } 203.0.113.55\ \text{AND}\ (\text{Brand detected} = \text{Service-A} \text{ OR domain registered between dates X and Y}), \text{ then flag as campaign.}
$$

These rules are validated using API data samples to minimize false positives. The paper also summarizes several anonymized case-study rules, including conditions based on `.co.jp.*.test` domains within a specific date range, a distinctive URL path such as `*/unique_string*`, an initial domain together with a final domain equal to an official site within a defined timeframe, a final IP combined with final status `403`, and a final ASN combined with a `.test` domain and a timeframe. Collectively, these examples show that rule generation is intended to convert heterogeneous investigative findings into compact search logic suitable for direct operational use.

## 5. Experimental evaluation

The empirical evaluation uses 103 manually confirmed campaigns comprising 6,020 URLs from JPCERT/CC data spanning January 2023 to March 2025, together with 1,000 benign URLs. Within this dataset, 77% of phishing URLs and 82.5% of campaigns were content-inaccessible, and the paper states that this condition was rising. These figures are central to the evaluation because the system is explicitly designed for environments in which content-based analysis frequently fails [2509.21772].

| Metric | Value | Note |
|---|---:|---|
| Median campaign coverage | 100% | Median case |
| Mean campaign coverage | 93.0% | Across campaigns |
| New malicious URLs discovered | 77,391 | 751 per campaign, mean |
| Later confirmed malicious | 80.5% | By VirusTotal |
| Lead time | 192.8 hours | Median, about 8 days ahead of expert confirmation |
| Execution time | 60.4 sec/URL | Median |
| Cost | \$0.23/URL | Commodity hardware |

The paper further reports that approximately 20% of the discovered malicious URLs were previously unseen and missed by many expert solutions, and that zero false positives were confirmed against top-ranked known-good domains. The timeliness result is particularly notable in operational terms: the system produced intelligence a median of 192.8 hours, approximately 8 days, ahead of expert confirmation by JPCERT/CC.

Under content-inaccessible conditions, evaluated over 85 campaigns, PhishLumos achieved an F1-score of 0.994, recall of 1.000, and a false positive rate of 0.001. The best baseline, ChatPhishDetector, reached F1 0.464 and recall 0.341, while vision-based detectors essentially failed with F1 below 0.03. On content-accessible cases, PhishLumos still outperformed all baselines with F1 0.973. The ablation study reported that removing Pivotal Analysis, or removing the Domain, IP, Certificate, or Campaign agents, each reduced coverage. Most strikingly, removing Rule Generation dropped coverage from 93.0% to 2.2%, which the paper presents as evidence of that component’s critical contribution.

## 6. Operational significance and research implications

PhishLumos is presented as a practical shift from reactive URL blocking to proactive campaign mitigation. Its outputs are detection rules and campaign intelligence intended for direct integration with browser, email, and cloud defenses, or for use by takedown teams. In that sense, the system is not only a classifier but also an intelligence production pipeline whose end products are designed for operational deployment [2509.21772].

The paper identifies several key contributions: proactive, infrastructure-centric phishing campaign mitigation rather than only URL blocking; an LLM-powered multi-agent system that reasons over lazy, minimal, or evasive signals; explicit use of evasion such as cloaking as an investigative trigger; empirical validation of detection rules to ensure actionable, low-false-positive intelligence; and substantial lead time over expert analysts together with scalability from a single seed URL. These contributions locate the work at the intersection of phishing detection, cyber threat intelligence, and LLM-based agentic orchestration.

A common misconception in phishing defense is that inaccessible content precludes reliable analysis. PhishLumos is built around the opposite operational stance: when content is blocked, cloaked, redirected, or reduced to error responses, those conditions can still support successful campaign inference if infrastructure artifacts are sufficiently informative. The reported performance on content-inaccessible campaigns gives empirical support to that stance. A plausible implication is that campaign-level mitigation may become increasingly important as evasive tactics become more common, because the paper’s dataset indicates that content-inaccessible phishing already accounts for a large majority of campaigns.

At the same time, the architecture implies a dependence on the quality of the pivots, the accumulated Knowledge Base, and the generated rules. The ablation results suggest that the system’s performance is not reducible to any single analysis module except in the sense that Rule Generation is indispensable for translating evidence into broad coverage. This suggests that the distinctive contribution of PhishLumos is the coupling of adaptive investigation with validated rule synthesis, rather than the isolated use of any single infrastructure signal.

Source: https://www.emergentmind.com/topics/phishlumos