Book a demo

Unphish platform

Every threat, every takedown, in one place.

We find the fakes using your name, our analysts check them, and you watch them come down, with the evidence on every case. Click around the example portal below.

Book a demoRun a free threat scan
Live demo · click anything
Overview

Example portal with made-up brands and data.

How a case moves

How each threat is taken down for good.

Every threat follows the same seven stages, and you can see exactly where each one is up to.

Stage 1 of 7

Threat intake

Our monitoring picks up a lookalike domain, fake account, copied app or scam ad using your name, around the clock.

WhoUnphish
What you seeA new item lands in your Threat Feed.

Stage 2 of 7

Analyst triage

AI-assisted analysis scores the threat and lists the signals behind it. An Unphish analyst checks it before it goes any further.

WhoUnphish analyst
What you seeA confidence score and the signals that set it.

Stage 3 of 7

Your call

Review threats yourself, or let us act for you. Approve with one click when the AI recommends a takedown, or tell us to go ahead without asking.

WhoYou, or us on your behalf
What you seeApprove, Watch or Dismiss, or a record of everything we actioned for you.

Stage 4 of 7

Case preparation

We build the evidence pack: screenshots, hosting and registration details, and your trademark and official sites.

WhoUnphish
What you seeThe Evidence and analysis tab on the case.

Stage 5 of 7

Enforcement

We send the takedown request to the right registrar, host or platform, and follow up until they act.

WhoUnphish
What you seeEvery request and reply on the case timeline.

Stage 6 of 7

Verification

We check the threat is really gone: DNS, the live page and fresh screenshots.

WhoUnphish
What you seeVerification status on the case.

Stage 7 of 7

Resolved

The case closes with the outcome on record, and we keep watching in case it comes back.

WhoUnphish
What you seeThe outcome, plus a case packet you can export.

Find and verify

AI-assisted. Analyst‑approved.

Our AI scores every detection, shows its working and recommends the next step. An Unphish analyst checks it before anything goes further.

  1. Scored, with reasonsEvery threat gets a confidence score that shows the signals behind it.
  2. Checked by a personAn analyst confirms it before anything is pursued, so you only see what matters.
  3. One-click enforcementThe AI recommends whether to take it down, watch it or dismiss it. Approve with one click and enforcement starts.
solsticepay-verify.topAnalysing…
0%confidence

Signals

  • Brand name in the address+22
  • Copied logo and login form+26
  • Domain registered 2 days ago+14
  • Hosting shared with 3 known phishing sites+20
  • Asks for a one-time code+12
Recommended: take down · analyst verified

Nothing is taken down by a machine alone. Every enforcement request is checked and approved by a person before it’s sent.

See how takedown works →
x.com/MeridianAirHelpX accountinstagram.com/meridian.refundsInstagram accounttiktok.com/@meridianpointsTikTok accountmeridian-rewards.shopWebsite+61 4XX XXX 218Shared contact numberTidewaterSyndicate
5 of 5 assets live

Example: made-up group and accounts.

Intelligence

Take down the whole network behind each account.

Scammers rarely work alone. We link fake accounts, sites and phone numbers that share the same operators, then go after all of them at once.

  1. CampaignsThreats grouped by shared hosting, page templates, payment details and contact numbers.
  2. Tracked groupsAnalyst-curated profiles of the groups that keep coming back.
  3. Attack wavesSee when a campaign spikes, so you know when to warn customers.

Monitoring

Watching every channel, around the clock.

Everything we find lands in one feed, whichever channel it came from.

→Domains and certificatesNew lookalike domains and certificates the moment they appear.→WebsitesPhishing pages, fake shops and cloned sites.→Social mediaFake profiles, support accounts and scam pages.→App storesFake and copied apps, in stores and on download sites.→Ads and searchScam ads and fake support numbers.→MarketplacesFake listings and counterfeit stores.→Messaging appsScam channels and groups using your name.→Dark webLeaked data and logins for sale.
WhitelistYour official sites, accounts and apps are registered, so we never flag you.
WatchlistSuspicious domains that haven’t done anything yet are watched until they make a move.
Action RequiredWhen we need a quick answer from you, it waits in one place.

Lookalike check

What could a scammer register in your name?

Type your domain and see the kinds of lookalikes we watch for: typos, swapped letters, other endings and add-ons like “-login”.

0 possible lookalikes for solsticepay.com

TypoSwapped lettersLookalike charactersOther endingAdd-on

    A sample of what someone could register. These are possibilities, not live sites. A free scan checks which ones actually exist.

    Find out which ones are live. Our free scan checks for real registrations and phishing pages using your name.

    Run a real free scan

    Integrations

    Works with your stack.

    Pull cases into your SIEM, push alerts into the tools your team already uses, or ask your AI assistant what’s been taken down this week.

    • REST APICases, threats, watchlist, brands and reports.
    • WebhooksSigned events the moment a case moves.
    • MCP serverWorks with Claude, ChatGPT and Cursor.
    • Threat feed and exportsSTIX 2.1, JSON, CSV and PDF.

    POST https://your-app.example/hooks/unphish

    {
  "event": "case.closed",
  "case_id": "CASE-20261012-A41D7E",
  "brand": "Solstice Pay",
  "target": "solsticepay-verify.top",
  "outcome": "domain_suspended",
  "verified": true
}

    Example data.

    Want to connect Unphish to your tools? Tell us what you use and we’ll show you how it fits.

    Talk to our team →

    Reporting

    Reports your board will actually read.

    Build a report from live case data, export it as a PDF, or schedule it to land in the right inbox every month.

    For leadership and boards: outcomes, trends and the threat mix in one page.

    • Threats taken down
    • Phishing
    • Social media
    • Scams

    For security and fraud teams: what came in, what’s open and what’s waiting on you.

    • New threats
    • Open cases
    • Awaiting your review
    • On watchlist

    For legal and compliance: how each case closed, with the evidence on record.

    • Domain suspended
    • Content removed
    • Other closure
    • Cases with full evidence pack

    Example data.

    Security and access

    Built for teams that ask questions.

    Your security team will want to know who can see what. Here’s how it works.

    • RequiredMulti-factor sign-inRequire MFA for everyone in your organisation.
    • Admin · AnalystRoles and accessInvite your team and choose who can approve, view or manage.
    • 30 minSession timeoutsSet how long people stay signed in.
    • Your networksIP allow listLimit access to your own networks.
    • Every actionFull audit trailEvery action on every case is logged, with who did it and when.
    • LightDarkLight or darkTry it: switch the portal at the top of the page.

    See it with your own brands. We’ll walk you through the portal using the threats targeting you today.

    Book a demo →

    FAQ

    Questions about the platform.

    Do I have to log in to the portal for anything to happen?

    No. Our team does the monitoring, analysis and takedown work. The portal is where you approve threats, answer our questions and see the results, and you can also get notifications and scheduled reports by email.

    How do you use AI?

    We use AI-assisted analysis to score every detection and show the signals behind it. An Unphish analyst checks each threat before it goes any further, and nothing is sent for takedown without a person approving it.

    Can my whole team use it?

    Yes. Invite as many people as you need and choose who can approve, view or manage. You can require multi-factor sign-in, set session timeouts and limit access to your own networks.

    Can I export evidence for legal or a regulator?

    Yes. Every case has an exportable case packet with screenshots, technical evidence and the full timeline, and reports can be exported as PDF or scheduled to the people who need them.

    Is there a limit on how many takedowns I get?

    It depends on your package. Some packages include unlimited takedowns, and we'll match yours to the volume of threats you see. Talk to us for a quote.