Beyond the Cease and Desist: Why Automated Blocking is the Fastest Defense Against AI-Generated Phishing
AI has changed the economics of phishing.
What once required time, technical expertise, and manual effort can now be generated automatically at an enormous scale. AI language models, autonomous AI agents, and even “vibe coding” enable attackers to create convincing phishing emails, cloned login pages, and supporting infrastructure in minutes. If one campaign is blocked, another can be launched almost immediately.
That shift has exposed a growing weakness in many organizations' response strategies. Legal workflows were designed for attacks that unfolded over days. AI-powered phishing campaigns often succeed in hours — or even minutes.
By the time a cease-and-desist letter is drafted, approved, and delivered, the phishing campaign has often already achieved its objective and moved somewhere else.
The velocity gap: Law vs. algorithms
Every phishing campaign has a window of opportunity to do the most damage. While that window for traditional phishing might last days or weeks, modern AI-generated campaigns can measure success in hours or even minutes.
But a legal cease-and-desist approach takes days to draft, approve, and send. Meanwhile, generative AI allows attackers to produce endless variations of phishing emails, fake websites, login portals, and brand impersonations at speed.
Research shows more than 37% of successful compromises occur during the early launch of a phishing campaign, called the “Golden Hours.” During those first hours, attackers are not just collecting credentials. They're also creating downstream fraud costs, damaging customer trust, and increasing recovery expenses.
Most cybercriminals aren’t launching a single phishing page at a time. Rather, they can deploy hundreds or thousands of unique versions simultaneously, each designed to evade signature-based detection.
Legal processes move at human speed. Modern phishing infrastructure scales at machine speed. When attackers can deploy new campaigns faster than defenders can act, organizations remain trapped in a reactive posture. The scale is equally concerning. Microsoft’s Digital Defense Report shows AI-driven phishing is 3 to 4.5 times more effective than traditional phishing campaigns, making manual investigation and legal enforcement increasingly difficult to sustain.
What’s more, the sheer volume of AI-generated phishing has made it nearly impossible for legal teams to keep up. Ginny Spicer, a cyber threat intelligence analyst at Netcraft, said, “The speed of spinning up convincing malicious infrastructure with AI creates a flooded threat environment. Legal enforcement against fast-moving scams can struggle to keep up as a result.”
As a result, brand protection has become an infrastructure race. If brand protection lives solely within the legal department, your organization is already behind.
Why “cease and desist" fails against AI phishing
Legal action still plays an important role in disrupting cybercrime. But as the primary defense against AI-generated phishing, it faces three major limitations.
Attackers hide behind anonymous infrastructure: Traditional cease-and-desist notices assume there is a legitimate organization to contact. Modern phishing infrastructure rarely offers that opportunity. Attackers frequently rely on compromised websites, bulletproof hosting providers, fast-flux infrastructure, anonymized domain registrations, and services designed to conceal ownership. Identifying a responsible party can take longer than the phishing campaign itself. Without a legitimate recipient, legal notices have little effect.
The hydra effect: Removing one phishing site rarely ends a campaign. AI enables criminals to recreate cloned websites across dozens of new domains almost instantly. According to Spicer, AI can introduce slight variations into the same scam deployed across multiple sites while agents can deploy across a range of services much faster than a human. Legal responses can’t scale at machine speed, but automation does.
Manual evidence collection takes time: Infrastructure providers need clear proof before they act. When teams capture screenshots, verify abuse, and assemble reports manually, attackers gain more time. Netcraft automates evidence collection and packages the technical detail providers need to act quickly.
The solution: Automated blocking and the "network effect"
When malicious infrastructure is identified and verified, modern digital risk protection platforms like Netcraft share threat intelligence directly with browser companies, antivirus providers, and ISPs. These partners can warn users and block access to malicious phishing sites before credentials are stolen. Blocking provides immediate protection while hosting providers and other infrastructure operators work separately to take the sites down.
This creates a powerful network effect, helping protect users across billions of devices and internet sessions.
For users, the experience is simple. Rather than landing on a convincing fake login page, they encounter a warning before they can interact with it. The phishing site may still exist behind that warning, but access is restricted while separate takedown work continues.
Speed without sacrificing accuracy is what makes this approach so effective.
The Netcraft advantage
Every minute a phishing campaign stays online increases its potential return for attackers. Reducing that exposure window is one of the most effective ways to undermine the economics of modern phishing.
Netcraft's Fraudcasting technology distributes verified phishing intelligence through feeds used by browser, security, and network partners. Classification and feed distribution happen at the point a threat is identified as malicious, whether or not it targets a Netcraft customer. Partners control how and when they apply warnings, but Netcraft typically describes browser blocking as occurring within five minutes of classification. Blocking applies to supported malicious attack types, such as phishing; it is not a substitute for takedown and does not apply to every category of online harm.
That speed also changes the economics of phishing. Attackers invest time, infrastructure, AI resources, and hosting costs because they expect a return. Rapid blocking changes that calculation.
If phishing pages are consistently blocked before they generate meaningful credential theft, attackers spend more creating campaigns than they earn from them. By breaking an attacker’s potential return, this makes future AI phishing attacks against your brand a poor investment for bad actors.
Rethinking what "taking down" really means
Blocking and takedown are distinct forms of disruption. Blocking restricts users from reaching supported malicious content, while takedown removes the underlying criminal infrastructure.
When a phishing threat is detected and classified as malicious, browser and security warnings should be distributed as quickly as possible to reduce user exposure — this is why the 5-minute response time is so valuable. However, implementing those warnings is controlled by browser companies and other partners, not by us.
Takedown is a separate process and can take longer, since it requires action from the relevant hosting or infrastructure provider. As of September 2026, Netcraft's year-to-date median takedown time for a phishing threat was approximately 47 minutes.
The strongest defense combines both approaches: automated blocking to provide immediate protection for supported malicious threats, with takedown efforts running in parallel to remove the infrastructure itself.
The next evolution in brand protection goes even further.
Organizations can use AI-driven detection to disrupt attacker infrastructure before phishing campaigns are even live. Netcraft’s Preemptive Domain Disruption enables organizations to jump “Left of Live™” to identify and disrupt criminally controlled domains before malicious content appears using Verified Attack Indicators.
“Netcraft catches threats through highly adaptable automation,” Spicer said. “In the case of AI-generated threats, automation is the only way to keep up. Then, adaptivity is the only way to catch varied threats that have the seed of randomness used in AI generation. Our systems have layers of detection clauses that allow us to regularly catch new and unique threats.”
AI demands a technical-first strategy
AI-generated phishing has permanently shifted the balance between attackers and defenders. In modern phishing defense, speed often determines success or failure.
Organizations can't rely on processes designed for an era when phishing campaigns unfold over days instead of hours. Legal action still has an important place in long-term enforcement, but it should no longer serve as the first line of defense.
The organizations that protect customers most effectively will be the ones that respond at machine speed: automatically identifying threats, blocking access, and disrupting attacker infrastructure before phishing campaigns can gain momentum — or even go live.
AI compressed the attack window from days to minutes. Defenders need to compress their response even further.
Reduce the phishing window with automated detection, blocking, and takedown.
What is AI-generated phishing?
AI-generated phishing uses AI language models, autonomous AI agents, and “vibe coding” to create convincing phishing emails, cloned login pages, and supporting infrastructure in minutes. These tools allow attackers to produce endless variations of fake websites, login portals, and brand impersonations at enormous scale.
Why are AI-generated phishing attacks difficult to stop?
AI-generated phishing attacks are difficult to stop because modern phishing infrastructure scales at machine speed. Attackers can deploy hundreds or thousands of unique versions simultaneously, each designed to evade signature-based detection, and launch another campaign almost immediately when one is blocked.
Why do cease-and-desist letters fail against AI phishing?
Cease-and-desist letters can take days to draft, approve, and serve, while AI-powered phishing campaigns often succeed in hours or even minutes. Attackers also rely on compromised websites, bulletproof hosting providers, fast-flux infrastructure, anonymized domain registrations, and services designed to conceal ownership, which can leave no legitimate recipient for a legal notice.
What is automated phishing blocking?
Automated phishing blocking focuses on preventing users from reaching supported malicious websites. When phishing infrastructure is identified and verified, threat intelligence can be shared with browser companies, antivirus providers, and ISPs so they can warn users and restrict access before credentials are stolen. Blocking is distinct from takedown, which removes the underlying infrastructure.
Is blocking a phishing site the same as taking it down?
No. Blocking restricts users from reaching supported malicious content, while takedown removes the underlying criminal infrastructure. Both matter: blocking can reduce immediate exposure while takedown efforts continue in parallel.
How should organizations respond to AI-generated phishing?
The strongest defense combines automated blocking with phishing takedown services. Organizations should use a digital risk protection platform that automatically identifies threats, blocks access, and disrupts attacker infrastructure before campaigns can gain momentum or even go live.
