---
title: "Why Smishing Sites Evade Detection, and How to Stop Them"
description: "Phishing sites now serve only mobile carrier IPs and mobile browsers to evade sandboxes. How adam:GO and adam:OSN still protect mobile devices."
url: https://adamnet.works/blog/why-smishing-and-phishing-sites-evade-detection/
index: https://adamnet.works/llms.txt
---

[All Articles](https://adamnet.works/blog/articles.md)

Articles · Phishing · Smishing · Mobile Security

# How and Why Smishing and Phishing Sites Aren’t Detectable with TrickyPhish

Phishing operators now hide their sites from sandboxes by serving only mobile carrier IP space and mobile browsers. How that extends a phishing site’s life, and how adam:GO and adam:OSN still protect mobile devices.

David Redekop | ADAMnetworks • September 10, 2024

![adam:GO and adam:OSN refusing a TrickyPhish link because it is not a verified destination](https://adamnet.works/uploads/why-smishing-and-phishing-sites-evade-detection-2.webp)

Fighting desktop email client phishing attack surface is improving to the point where a lot of phishing sites need a single SafeBrowsing-equipped browser (Chrome, Safari, etc) submit meta-data to centralized threat intelligence service, which can detect and immediately protect every other SafeBrowsing-equipped user. Furthermore, Security Awareness Training, has helped users be somewhat more cautious in clicking links.

However, the malicious actors aren’t idly standing by as they watch their phishing site go undetected-as-bad from months, to weeks, to days, to only hours or minutes-long life in many cases.

In our own experience we now see that malicious actors have extended their phishing sites’ lifetime by applying two key techniques:

1. Block all IP connections unless they come from carrier-owned IP space. This turns out to represent the vast majority of sandboxes that crawl the internet for threats or threat verifications.
2. Block all non-mobile user agents, or screen resolutions that aren’t likely a mobile device.

![A phishing site serving content only to visitors on a mobile carrier network with a mobile browser](https://adamnet.works/uploads/why-smishing-and-phishing-sites-evade-detection-1.webp)

These two techniques makes it so that the VirusTotals of the world have a difficult time detecting a phishing site.

However, with Zero Trust Connectivity, there are now multiple layers of protection that protects a mobile device no matter how or where it connects:

![adam:GO and adam:OSN refusing a TrickyPhish link because it is not a verified destination](https://adamnet.works/uploads/why-smishing-and-phishing-sites-evade-detection-2.webp)

## Related reading

Announcements

### [ClickNix: a free browser extension that stops ClickFix attacks before they reach the user](https://adamnet.works/blog/clicknix-launch.md)

October 9, 2026

Security Research

### [KeyStealth: Device code phishing to rogue Entra devices and BEC](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md)

October 22, 2026

Podcast

### [Decoupling Digital Identity: Beyond Carrier-Level Defense](https://adamnet.works/podcast/tdl-29-decoupling-digital-identity-beyond-carrier-level-defense.md)

September 1, 2026

## See it on your own network

Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment.

[Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)