# How Phishing Shield works

> What Phishing Shield is, how it analyzes pages in the browser, the phishing it detects, its twelve detection engines and what happens when it blocks a threat.

URL: https://docs.ironchip.com/en/phishing-shield/como-funciona/

Phishing Shield is a phishing protection solution that works directly in the browser, in real time. It detects and blocks malicious pages before users can fall for them.

[Image: Phishing Shield Website blocked screen shown during an AiTM attack that clones the Apple sign-in page]

## How it works

When a user tries to open a web page, Phishing Shield analyzes the site and checks whether it shows signs of phishing or belongs to a set of domains identified as potentially malicious.

## What problem it solves

Phishing Shield protects your users from reaching fraudulent sites, identity impersonation and credential theft, and neutralizes malicious links before they have an impact.

Video: [Phishing Shield demo in the browser](https://play.hubspotvideo.com/v/7745202/id/222593964409)

## Types of phishing it detects

Phishing Shield is designed to detect the different techniques attackers use to deceive users, from fake pages to more advanced methods of stealing information:

- **Fake pages:** websites that imitate well-known services and brands to deceive the user.
- **Deceptive domains:** web addresses very similar to the originals, with swapped letters or characters.
- **Impersonation:** pages that pose as legitimate companies or services.
- **Credential and session theft:** attacks designed to obtain passwords or take over signed-in sessions.
- **QR code phishing:** QR codes that send the user to malicious pages.
- **ClickFix:** pages that trick the user into performing dangerous actions on their computer.
- **Adversary-in-the-middle (AiTM) attacks:** advanced techniques that try to intercept the user's credentials or sessions.
- **Hidden pages or pages designed to evade protections:** techniques that hide the malicious content to avoid detection.

Phishing Shield combines several detection mechanisms to identify these threats and block them before they have an impact. See the [Phishing Shield overview](https://docs.ironchip.com/en/phishing-shield/) to learn how it is deployed and managed.

## The twelve detection engines

Each engine handles a different attack and, together, they also cover the ones that bypass MFA. The screenshot below shows the result of each check in the **Full security analysis** panel.

- **Content cloning:** analyzes the structure, elements and visual design of a page to identify cloned sign-in pages, including perfect copies that evade URL filters.
- **Typosquatting:** detects domains almost identical to the original, such as `g00gle.com` or `mircosoft.com`.
- **Homoglyphs:** detects Unicode tricks, such as a Cyrillic "a" posing as a Latin "a".
- **AiTM and reverse proxy:** identifies the kits that sit between the user and the service (Tycoon2FA, EvilProxy, Sneaky2FA, Evilginx, Modlishka, Caffeine, Greatness) from the page's headers, timings and resource patterns.
- **ClickFix:** intercepts attacks that hijack the clipboard and blocks the malicious PowerShell or curl commands they try to make you run.
- **Form hijacking:** detects forms that secretly send your credentials to an attacker's server.
- **QR phishing (quishing):** detects QR codes that lead to credential-theft pages.
- **VNC attacks:** stops shared-screen attacks in which the attacker watches what you type in real time.
- **Session hijacking:** watches for token theft even after you have signed in, by observing changes to the browser's cookies and storage.
- **MFA bypass:** alerts when an attacker intercepts your second-factor codes in transit by relaying tokens through an AiTM kit.
- **Threat intelligence:** cross-checks an in-house database of more than one million trusted domains, curated phishing URL lists and more than 18,000 known malicious IPs, updated continuously.
- **Phishing database:** blocks known phishing sites before the user sees the page, using the PhishTank and OpenPhish feeds.

[Image: Full security analysis panel with the result of each check (homoglyphs, typosquatting, phishing database, IP, VNC, AiTM, cloning, QR and ClickFix) and content cloning flagged as Detected]

## What happens when a threat is detected

When Phishing Shield detects a possible threat, it acts automatically to protect the user:

1. **Detects** the possible threat while the user browses.
2. **Blocks** access to the page so the user cannot interact with it.
3. **Informs** the user with a warning screen.
4. **Logs** the attempt so the organization knows about the threat detected and the user protected.

This way, Phishing Shield steps in in real time and keeps access to a malicious page from turning into a security incident.