> an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser Credential phishing doesn’t care where your browse

> an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up). > [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen... Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.