URL inspection — MAIL PRISM AI
Email is only the gateway. The real target is your information assets
The real aim of phishing is not your mail system. Payment systems, privileges, financial documents, cloud accounts — stealing the organization's core assets is the end goal.
Source: Spacelift, ‘AI-Generated Phishing: The Top Enterprise Threat of 2025’
Attacks on people
Sophisticated spam built to fool users
Spam built to deceive people is polished enough to be hard to tell from the real thing.
Fake HR / admin notice
Sent in the name of HR or general affairs, it asks you to change your salary account or update personal details. Short sentences and a polite tone stress urgency to push for an immediate response.
Fake supplier invoice
It copies a real supplier's invoice format and attaches a malicious PDF or link. It mainly targets accounting staff, so the click feels like part of the job.
Fake security alert
Nearly indistinguishable from real security messages such as MFA or password-change requests. It borrows domains, logos and terminology to win trust and lure a click on a malicious link.
Fake delivery notice
Disguised as a delivery update, tracking lookup or delay notice, it carries a malicious link. Because these arrive every day, people let their guard down — click rates are especially high on mobile.
Attacks on scanners
Attacks that evade existing security systems
Attacks aimed at automated filters and ML-based detectors use different techniques from emails aimed at people.
Polymorphic content
Body, subject and links change automatically to dodge signature-based detection.
Environment-based cloaking
Malicious content appears only in certain environments (User-Agent, IP, browser), evading scanners and hitting only real targets.
Image-based body
Text is embedded as an image to avoid text analysis and keyword detection.
Zero-day URL generation
URLs are generated at delivery time, so they rarely make it onto blocklists.
Time-based cloaking
Malicious content appears only at certain times, so scanners see a clean page.
Spam copy optimization
Subjects, wording and links are tested at small scale, then the least-detected combination is sent in bulk.
Keyword and header checks alone now struggle to detect these. It takes an approach that looks at behavior and environment together.
Real-user behavior replay
It opens links the way a real user would — and watches what changes
To cover the limits of static analysis, MAIL PRISM AI's URL inspection behaves like a real user and tracks how the page changes over time.
- Full JavaScript execution in a real browser environment
- Simulated mouse clicks, scrolling and keyboard input
- Tracks page changes over time
- Reproduces real-user conditions (IP, User-Agent, Referer and more)
- Detects hidden DOM elements and off-screen content
- Checks the real content behind anti-bot measures
Compared with static analysis
| Capability | Static analysis | MAIL PRISM AI URL inspection |
|---|---|---|
| Time-delayed attacks | Not possible | Detected |
| Conditional (environment-specific) attacks | Not possible | Detected |
| Hidden content | Rarely | Detected |
| Anti-bot evasion | Insufficient | Evasion techniques identified |
| JavaScript execution | Limited | Fully supported |
| User interaction replay | None | Supported |
| Zero-day response | Signature-dependent | Behavior-based detection |
We open the real attack first — hidden threats included — and stop it.