Bluekit PhaaS: Phishing Email to Click to Anomalous Sign-In Correlation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.