07:42 AM.
The first phishing domain of the day is already live.
A fake airline rewards portal is harvesting credentials.
A fraudulent gambling platform is redirecting users to scam websites.
New impersonation domains appeared overnight.
And the workday hasn’t even properly started yet.
Welcome to Threat Operations at unphish.
The First Thing We Check Every Morning
Every morning starts with the Threat Feed.
New phishing domains.
New impersonation attempts.
New scam campaigns targeting global brands.
The Threat Feed is more than just a list of suspicious domains – it’s where we analysts validate threats, prioritise risk, and determine the most effective enforcement pathway.
Some threats are immediately obvious.
Others require much deeper investigation.
A website may appear completely inactive at first glance, only to reveal phishing content when accessed from a mobile device connected through a VPN.
Some campaigns only target specific countries.
Some disappear minutes after going live.
Others reappear days later under completely different domains.
You’d be surprised how sophisticated phishing infrastructure has become when it comes to avoiding standard detection methods.
Not Every Threat Is What It Seems
One of the most important parts of the role is validation.
Not every suspicious domain can immediately be actioned.
Before any enforcement action is taken, analysts must confirm:
- Is the website actively phishing users?
- Is the brand being impersonated?
- Is there credential harvesting or financial fraud involved?
- Is the content geo-restricted or mobile-only?
- Is the domain compromised, or intentionally malicious?
Sometimes the smallest details make the biggest difference.
A slight URL variation.
A redirect chain.
A cloned login page.
A fake rewards portal designed to look almost identical to the legitimate website.
During investigations, analysts review hosting infrastructure, domain registration patterns, redirects, screenshots, and phishing functionality to determine the most effective enforcement strategy.
The Enforcement Process
Once sufficient evidence has been gathered, the next step is disruption and enforcement.
At unphish, this process involves far more than simply submitting standard abuse reports. Analysts assess each threat individually based on the infrastructure involved, provider policies, risk level, and likelihood of successful action.
Detection tooling, automation, and AI-assisted analysis help surface suspicious activity at scale, but human validation remains critical to confirming threats and determining the most effective response pathway.
Depending on the threat, analysts may coordinate enforcement across infrastructure providers, platforms, hosting environments, search engines, marketplaces, and other online services.
Some threats are disrupted quickly.
Others require ongoing monitoring, escalation, intelligence gathering, and infrastructure tracking before meaningful action can be achieved.
Threat actors constantly adapt, which means enforcement strategies need to evolve just as quickly.
A Constantly Evolving Landscape
One of the biggest challenges in Threat Operations is how quickly threats evolve.
A phishing domain may disappear minutes after detection, only to reappear days later using entirely new infrastructure.
A fake social media account may be removed while several more appear overnight.
Some campaigns operate simultaneously across websites, messaging platforms, Telegram channels, fake mobile applications, and social media accounts.
That’s why monitoring becomes just as important as enforcement itself.
At unphish, analysts continuously track recurring threat actors, monitor watchlisted infrastructure, analyse campaign patterns, and monitor threats that may become active again across new domains, platforms, or providers.
More Than Just Takedowns
Threat Operations is often viewed as simply removing malicious websites or fake accounts.
In reality, there’s a much larger operational process happening behind the scenes.
Detection improvements.
Threat validation.
False positive analysis.
Monitoring operations.
Platform testing.
Enforcement quality assurance.
Workflow optimisation
Analysts continuously refine workflows and detection processes to help threats be validated faster, enforcement actions become more effective, and recurring campaigns be identified earlier.
Why It Matters
Behind every phishing website or impersonation campaign are real people who could potentially lose personal information, credentials, or money.
Threat Operations is ultimately about reducing that harm and disrupting malicious activity before more users are impacted.
At unphish, analysts work every day to help organisations detect, investigate, and respond to increasingly sophisticated online threats.
It’s fast-paced.
Constantly evolving.
And sometimes, before the first coffee of the day is even finished, another phishing campaign is already waiting to be investigated.