We are fighting phishing at the wrong layer

From registering a domain to having it delegated, certificated and serving a live credential-harvesting page took under 24 minutes, and 12 of those were spent waiting on nameservers. I keep coming back to that number, because it quietly indicts most of what we do about phishing. We feed them to our gateways and our DNS filters and our threat intel platforms; we measure how many we have blocked, and we report the figure to a board that finds it reassuri