Book a demo

Compromised website protection

Phishing hidden on hacked sites, taken down.

Attackers break into real businesses' websites and hide phishing pages that impersonate your brand. Unphish finds them and works with the site owner and hosting provider to remove the phishing page, without taking the real business offline.

Book a demoRequest a takedown
Hacked site · phishing for “Solstice Pay”Example
  1. Site
    harbourkitchens.com.auReal local business, hacked without knowing
    Compromised
  2. Folder
    /wp-content/wonder/rewards/Phishing kit hidden where the owner never looks
    Found
  3. Owner
    Site owner alerted firstEvidence sent so they can remove the kit
    Notified
  4. Host
    Hosting provider, if neededAsked to remove only the phishing page
    Page removed
1phishing page removed
0pages of the real site lost
Upbusiness stays online

How it works

Found in the folders nobody checks.

Phishing on a hacked site sits on a real business's domain, buried a few folders deep where the owner never looks. We find it, prove it, and get the page removed while the business's own site stays up.

01

Detect

We find the pages hiding on real sites.

Phishing and scam pages using your brand are found wherever they're hosted, including deep folders, subdomains and uploaded files on legitimate websites.

Hidden foldersSubdomainsUploaded filesRedirectsTeam reports
02

Investigate

Show the phishing kit is separate from the business.

We capture the page, its exact path and the hosting details. AI-assisted analysis scores the risk, and an analyst confirms the content is malicious before anyone is contacted.

AI-assisted analysisScreenshotsPage pathKit fingerprint
03

Disrupt

Owner first, then the host.

Reviewed cases go to enforcement in one click. We alert the site owner or their support team first, then escalate to the hosting provider if needed, asking for the phishing page to be removed. The real business stays online.

One-click enforcementSite ownersHosting providersEscalation
04

Understand

See the whole campaign behind every site.

Sites carrying the same phishing kit are linked into one campaign, so you can see how far it has spread, and removed pages are checked so you spot it when it comes back.

Campaign linksVerification checksReportsAudit trail

Where it hides

Six places phishing hides on a hacked site.

Attackers bury their pages where the site owner won't stumble on them. These are the spots we find them in most.

Hidden folders

kitchens.com.au/wonder/rewards

A phishing kit uploaded into a folder the owner never opens

Brand subdomains

solsticepay.petstore.com

Your name added in front of someone else's domain

Uploaded files

/uploads/support.pdf

PDFs with fake support numbers uploaded to trusted sites

Old system folders

mail.site.co.uk/_vi_php

Forgotten mail and admin folders on old servers

Redirects

realbiz.com.au → fake login

A hacked page that quietly forwards visitors on

Trusted platforms

forms.trusted.com/solstice

Forms and site builders on platforms people already trust

Seen your brand on someone else's site?

Send us the link. We'll check it, capture the evidence and get the phishing page removed with the site owner and their host.

Send us the link →

The results

Proven on real hacked sites.

From compromised website cases we closed for our clients in the first half of 2026.

100%

of compromised website cases we pursued were disrupted

68%

of the 22 hacked sites hid the phishing page in a folder the owner never opens

22

hacked sites found hosting phishing against one brand

7

countries those hacked sites were registered in, including Brazil and Romania

Where the phishing was hidden

  • Hidden folder15 sites
  • Brand subdomain2 sites
  • Uploaded file2 sites
  • Trusted platform2 sites
  • Redirect1 site

Most of the time it's a folder the owner never opens, on a site that looks completely normal from the homepage.

Source: Unphish compromised website cases opened January to June 2026. Countries counted from country-code domains (.au, .nz, .uk, .ro, .es, .br, .ar).

Case study · Airline loyalty programme

7

unrelated hacked sites carrying the same phishing kit, linked into one campaign.

Every one had the same hidden /wonder/rewards/ folder, serving a fake points page to the programme's members. None of the owners knew it was there.

What we found

  • Seven ordinary businessesA real estate agency, a kitchen maker, an IT repair shop, a leasing firm and more, in Brazil, New Zealand, Romania and beyond
  • One campaignMatched by the shared folder path and page code, then handled together
  • Every phishing page disruptedEach site owner and host was contacted to remove the kit, and three of the pages were down within a day

Client name withheld to protect confidentiality. February 2026.

Why hacked sites

A real business is the perfect disguise.

A brand-new lookalike domain is easy to spot and quick to block. A hacked site has years of history and a real business behind it, so phishing hidden on it can slip past the filters that would catch a new domain. It also needs a different takedown: remove the page, keep the business.

  • The domain has history and a clean reputation
  • A security certificate is often already in place
  • The homepage looks completely normal
  • The owner has no idea the page exists
Explore domain protection →
Side by sideTypical
New lookalike domainHacked real site
Domain age

Days old

Years old

Reputation

None yet

Established business

Certificate

Freshly issued

Already in place

Who we contact

Registrar or host

Site owner, then host

What's removed

The whole site

Just the phishing page

22hacked sites in six months
7countries
100%disrupted

Scams Prevention Framework

Ready for Australia's Scams Prevention Framework?

The SPF requires banks, telcos and digital platforms to take reasonable steps to prevent, detect, disrupt and report scams. Unphish gives you the action and the evidence to show you have.

How Unphish supports the SPF →

01

Prevent

Spot lookalike domains, fake profiles and scam ads before they reach your customers.

02

Detect

Continuous monitoring across the web, social media, app stores and ads.

03

Disrupt

Rapid removal of scam websites, accounts and ads, backed by enforcement-grade evidence.

04

Report

A complete audit trail of every detection and takedown, ready for regulator reporting.

What's included

Everything you need to get your brand off hacked sites.

CasesSearch…⌘K
←CW-0412P1Export Case Packet
https://harbourkitchens.com.au/wp-content/wonder/rewards/login.phpUnphishScan

Case status

Resolved

State: Closed

Verification history

Page downSite: ✓ up | Phishing page: ✕9 Sep 2026, 16:42
Desktop screenshotCaptured
Solstice Pay RewardsSign in to claim your pointsSign in
OverviewEvidence & AnalysisTimelineNotes

Description of abuse

Phishing kit hidden in a folder on a hacked kitchen business website, impersonating Solstice Pay rewards to collect member logins

Threat type
Compromised website
Category
Web / Hosting
Detected
8 Sep 2026
Campaign
Same kit on 6 other sites

Outcome

Phishing page removed

  • Screenshot evidence available
  • Site owner notified
  • Hosting provider notified

Add a comment

Add a comment for your enforcement team
Add comment

Illustration of the Unphish client portal with example data.

Hacked site detectionPhishing and scam pages using your brand on legitimate websites
Deep path discoveryHidden folders, subdomains, uploaded files and redirects
Page-only removalWe ask for only the phishing page to be taken down, so the business's site stays up
AI-assisted analysisScreenshots, page path, page source and hosting details risk-scored and validated by an analyst
One-click enforcementReviewed threats move straight into takedown, where configured
Owner first, then the hostWe contact the site owner or support team first, then escalate to the hosting provider
Removal verifiedAutomated checks confirm the page is gone and flag it if it reappears
Threat intelligenceSites carrying the same kit clustered into one campaign
Spotted one? Send it inIf your team or customers find a hacked site, flag it and we'll take it from there
Reporting and audit trailDashboards, timelines, scheduled reports and a record of every action

Found your brand on a hacked site?

Request a takedown →

FAQ

Compromised website questions, answered.

What is compromised website protection?

It means finding legitimate websites that have been hacked and are being used to host phishing or scam pages that impersonate your brand, then getting that content removed before your customers are caught.

Why do attackers use hacked websites?

A hacked site comes with an established domain, a real business behind it and often a valid security certificate, so it's less likely to be blocked than a brand-new domain. The owner usually has no idea the page is there.

How do you get it removed?

We contact the website owner or their support team first, then the hosting provider. We ask the host to contact the owner or remove only the phishing page, and we track the case until the page is confirmed gone.

Will the hacked business's website be taken down?

No. We ask for only the phishing page to be removed, so the rest of the site stays online. The business is a victim too, so we contact them first and only involve their hosting provider when needed. You don't have to chase anyone yourself.

Can you tell when the same attacker is behind several sites?

Yes. Attackers often plant the same phishing kit on many hacked sites at once. We match the shared folder paths and page code, link them into one campaign and report them together.

Can we report hacked sites our customers find?

Yes. Your team can send us any suspicious link at any time, and it goes through the same evidence, validation and takedown process.

Does Unphish help with UK scam and fraud rules?

Yes. Unphish helps UK organisations detect, disrupt and document impersonation, with a full audit trail of every detection and takedown. That record supports your work under the Online Safety Act and APP fraud reimbursement rules.

Threat intelligence challenge

Can you connect the campaign?

Five real businesses have been hacked and are hosting phishing pages that copy Solstice Pay. Some are the work of the same attacker. Can you tell which?

  1. Investigate
  2. Reveal
  3. Take down

Which sites are linked?

Tap every site you think belongs to the same campaign. Look closely at the details.

Pick at least two sites, then check your answer.

Results

Shared by the campaignKit A7F2-9Capi.collect-pts.top

  1. Linked
    harbourkitchens.com.auSame kit fingerprint and sends data to the same endpoint.
  2. Linked
    limaimoveis.com.brDifferent country and host, but the kit and endpoint match exactly.
  3. Not linked
    kiwifixit.co.nzA different kit sending data somewhere else. A separate attack.
  4. Linked
    leasingcorp.roThe folder path is slightly different, but the kit and endpoint give it away.
  5. Not linked
    petpalace.co.ukIt shares a host with harbourkitchens, but nothing else. A shared host alone isn't a link.

Take it down

Three hacked sites, one campaign. The businesses are victims too, so each page is taken down without taking their site offline.

Each hacked siteOwner first, then host

Every site owner is alerted first, with the hosting provider asked to remove the page if needed.

Shared endpointTakedown

Taking down api.collect-pts.top cuts off the data from every page in the campaign at once.

The kit itselfWatch

Its fingerprint is tracked, so the next site it turns up on is linked straight away.

Look beyond the single site. Shared kits, endpoints and timing can link threats that look unrelated. One shared detail on its own, like a host, usually isn't enough.

Liked that one? Follow us on LinkedIn for scam insights, research, takedown stories and company news.

Follow Unphish on LinkedIn

By industry

Hacked-site phishing in your industry.

Attackers pick the brand their phishing kit copies. See what we find on hacked sites in your sector.

01

Banking and Financial Services

Fake bank logins hidden in other sites' folders.

02

Fintech

Fake wallet and payment pages.

03

Crypto

Wallet-draining pages on hijacked sites.

04

Retail and E-Commerce

Fake checkout and order pages.

05

Airline and Transport

Fake loyalty points and rewards pages.

06

Lottery and Gambling

Fake account and prize claim pages.

07

Public Sector and Government

Fake payment portals and uploaded fake notices.

08

Non-Profit Organisations

Fake donation pages.

09

Film and Entertainment

Fake streaming and ticket logins.

Keep exploring

SolutionPhishing ProtectionTake down the sites stealing logins → SolutionDomain ProtectionCatch lookalike domains early → SolutionScam ProtectionTake down every piece of the scam → SolutionTakedownHow our takedowns work →

See where your brand is being abused.

Run a free threat scan or book a demo to see what's targeting your customers right now.

Book a demoGet a free threat scan