PhishLens · BDR
See PhishLens defend a click, live
A personalised walkthrough of how PhishLens detects, decides, and contains phishing inside the browser session — before credentials or damage happen.
What's included:
Real-time, click-time phishing detection
Credential-theft prevention at submit
Sandbox isolation for unknown destinations
URL, domain & browser fingerprint intelligence
Forensics handoff to your SOC / SIEM
Managed browser policy rollout (Chrome & Edge)
Our team will get back to you within 24 hours
PhishLensBDR
Browser Detection & Response·by Craw Security
See threats.
Stop them.
Defence at the moment of the click
Modern phishing executes inside the browser. So does BDR.
Real-time detection, credential-theft prevention, and sandbox isolation inside the browser session — with forensics pushed to your SOC before the page finishes loading.
Your last line of defence after email and network controls have already passed the link.
PhishLens — how BDR stops a live phishing click
detect · decide · contain · coach
verdict in 36ms
7
controls
Detection and response capabilities
4
signal types
URL, domain, fingerprint, behaviour
3
response modes
Warn, sandbox, or block
1
extension
Deploys through managed browser policy
How BDR works
One click. Eight stages. Under a second.
Detection, decision, and containment happen while the page is still rendering. The panel on the right is what the person who clicked actually sees at each stage.
01 / 08
Session
Detect
Decide
Respond
Report
Coach
01
Session
t + 0 ms
The click lands inside the session
A link from a QR code, a chat forward, or a personal device opens in the managed browser. Email and network controls are already behind it — PhishLens takes over from here.
Signal types engaged
URL
Path, parameters, look-alike spelling
Domain
Age, reputation, redirect chain
Fingerprint
SSL surface, cloned page structure
Behaviour
Script obfuscation, form and download activity
hr-policy-update.in/q3-handbook
BDR Opened from outside your gateway
rendering…
Signal ledger0/4 detected
No reputation history for host—
Redirect chain crosses 3 domains—
Auto-download triggered on load—
Script obfuscation detected in DOM—
0/100
0 ms · click
forensics captured · pushed to SOC
Timings illustrate the order of operations. Actual latency varies with page complexity and intel-feed response.
Milliseconds, not tickets.
Three response modes sit behind the verdict. The SOC gets context automatically, and the person who clicked gets coached instead of scolded.
Elevated risk
Warn
Interrupt and explain
The page is marked in-session with what looks wrong, so the person decides with the evidence in front of them instead of a generic warning banner.
Unknown destination
Sandbox
Contain, then investigate
Unknown destinations open in a controlled session so analysis costs nothing and the analyst never has to re-click the original link.
Credential risk
Block
Blocked before submit
Credentials never reach the fraudulent host, even if the page looks perfect. The submit is stopped, not just the navigation.
Example bands. Which action fires at which risk score is set by your policy.
Why BDR matters now
The perimeter moved into the browser tab.
Traditional controls stop many threats at the edge, but browser-native campaigns get through — QR links, personal devices, and high-fidelity fake portals never pass your gateway at all.
BDR gives security teams visibility and control inside the session: detect intent, block the risky action, and cut the user-driven breach path.
The link never touches your gateway
A QR code on a poster, a WhatsApp forward, a personal device — the click happens somewhere your email and network controls never see.
- QR and mobile-origin links
- Personal and unmanaged devices
- Chat, SMS and social forwards
Fake portals are pixel-perfect
Modern kits clone your SSO page, proxy the real login, and relay MFA in real time. Nothing looks wrong to the person typing.
- Cloned SSO and webmail portals
- Real-time MFA relay
- Valid certificates on hostile hosts
Detection arrives after the fact
By the time a phishing domain lands on a blocklist, the credentials are already gone. Protection has to act at click time.
- First-seen domains beat blocklists
- Campaigns rotate hosts hourly
- Alerts land after the submit
What each layer actually sees
Every control below matters. None of them are in the session when the credentials are typed.
| Control layer | QR / mobile-origin link | Personal device | Cloned SSO portal | MFA relay in session | Block at submit |
|---|---|---|---|---|---|
| Email security | No visibility | No visibility | Partial | No visibility | No visibility |
| Secure web gateway | No visibility | No visibility | Partial | No visibility | No visibility |
| Endpoint detection (EDR) | Partial | No visibility | No visibility | No visibility | No visibility |
| PhishLens BDR | In session | In session | In session | In session | In session |
Core capabilities
Detection and enforcement, inside the session.
Every signal is scored together, so a verdict reflects the whole session rather than a single blocklist lookup.
Detect
Real-time threat detection
Monitor browser activity to detect phishing pages, malicious redirects, and suspicious scripts before harm occurs.
- Phishing pages scored at render time
- Redirect chains followed end to end
- Script execution watched in-page
Prevent
Credential theft prevention
Identify fake login pages and block credential submissions to fraudulent domains at the moment of submit.
- Protects SSO and webmail portals
- Stops the submit, not just the page
- Works on first-seen domains
Detect
Browser fingerprint analysis
Detect anomalies such as spoofed URLs, cloned SSL surfaces, and suspicious DOM behaviour.
- Look-alike and homoglyph URLs
- Cloned certificate surfaces
- Hidden and injected form fields
Intel
URL & domain intelligence
Validate visited links against threat-intel feeds, newly registered domain signals, and typosquat detection.
- Threat-intel feed validation
- Newly registered domain signals
- Typosquat and brand-abuse checks
Enforce
Policy enforcement
Apply browser-level controls to block known malicious destinations and risky downloads.
- Destination blocking by policy
- Risky downloads stopped at source
- Different bands per user group
Contain
Sandbox mode
Isolate unknown destinations in controlled browser sessions to reduce blast radius during investigation.
- Isolated session for unknowns
- No blast radius while analysing
- Analyst review without re-clicking
Running it
Built for the team that has to operate it.
Incident response integration
Forensic context is captured on every detection and pushed to SOC, SIEM, and response workflows automatically.
Policy-driven actions
Decide per policy what happens at each risk band — warn, sandbox, block the submit, or block the destination outright.
Managed browser rollout
Deploy the extension through existing browser management rather than touching every endpoint by hand.
Rollout
Browser-layer response in weeks, not quarters.
Monitor first, tune policy against real traffic, then enforce with confidence.
01
Week 1
Pilot group
Deploy to a pilot cohort in monitor-first mode and tune policy against your real traffic before enforcing.
- Extension pushed by browser policy
- Monitor-only detections
- Baseline of real click traffic
02
Week 2
Enforce and integrate
Switch on blocking and sandbox actions for the risk bands you chose, and wire alerts into your SOC workflow.
- Risk bands mapped to actions
- SIEM and alerting handoff live
- Sandbox policy for unknown hosts
03
Ongoing
Operate and coach
Review detections with simulation results side by side, and route the people who clicked into training.
- Detection and simulation review
- Coaching triggers per click
- Policy tuned on live evidence
Chrome & EdgeManaged policy deploySOC / SIEM handoffMonitor-first mode
Get PhishLens for your organisation
Defence at the moment of the click.
Your last line of defence after email and network controls have already passed the link. Talk to us for a live demo or pricing tailored to your browser fleet.
Contact us at the 24×7 hotline: +91-9513805401 — to learn more or speak with a member of our team.