Book a demo

Phishing protection

Phishing sites found and taken down.

Unphish finds the phishing websites and cloned login pages targeting your customers, proves they're malicious and gets them offline. Then we watch for them coming back.

Book a demoRequest a takedown
Case · Phishing websiteExample
solsticepay-verify.top/login
Solstice PaySign in to your accountEmail addressPasswordSign in
Cloned login page · 96% confidence
  1. DetectedNew SSL certificate on a lookalike domain09:12
  2. ValidatedEvidence captured, analyst confirmed09:24
  3. Takedown sentNotice to the hosting provider09:38
  4. EscalatedNo response, sent to the registrar10:46
  5. OfflineConfirmed down and watched for a comeback11:09

How it works

We follow every phishing site until it's offline.

Phishing sites go up fast and move often. We watch the places they start, prove what's real and keep going until they're gone.

01

Detect

We watch where phishing starts.

New domains, certificates and DNS changes are checked as they appear, along with ads, search results and links your team reports.

Domain registrationsSSL certificatesDNS changesAds and searchTeam reports
02

Investigate

AI scores it. An analyst confirms it.

Evidence is captured automatically, AI-assisted analysis scores the risk and recommends an action, and a security specialist validates it before anything is enforced.

AI-assisted analysisScreenshotsPage sourceKit fingerprints
03

Disrupt

Takedown sent. Escalated until it's gone.

Reviewed threats go to enforcement in one click. We send an evidence-backed request to the right provider and keep escalating if they don't act, tracking the case until the site is offline.

One-click enforcementHostRegistrarEscalation
04

Understand

Watch for it coming back.

Removed sites are verified and monitored for re-hosting and copycats, related sites are clustered into campaigns, and every action is logged.

Re-hostingCampaign linksReportsAudit trail

Beyond the website

Phishing doesn't stay on one channel.

The same campaign behind a fake website often shows up as a lookalike domain, a fake support account, a cloned app or a scam ad. We follow it wherever it goes.

$97.6m

reported lost to phishing in Australia in 2025

Source: National Anti-Scam Centre, March 2026
DomainsLookalike domainsTypos, homoglyphs and new extensions using your name → Social mediaFake accountsImpersonator profiles and fake support pages → Mobile appsCloned appsFake apps on official and third-party stores → AdsScam adsPaid ads and search results pushing fake sites →
See all solutions →

The results

Proven on real phishing cases.

From phishing website takedowns we closed for our clients in the first half of 2026.

99%

of phishing sites we pursued were taken offline

79%

of phishing sites were registered outside .com

100%

of cases checked by an analyst before a takedown is sent

5

levels we escalate through: host, upstream, CDN, registrar and registry

Where phishing sites were registered

.com21%
.top18%
All others28%
.shop10%
.click9%
.cc4%
.net4%
.ru3%
.info3%

Cheap newer extensions like .top, .shop and .click are now nearly as popular with scammers as .com. We take sites down wherever they're registered.

Source: Unphish phishing website cases opened January to June 2026.

Case study · Airline loyalty programme

250+

malicious and suspicious instances found in our first sweep.

Phishing sites were only part of it. The same members were being targeted across the open web, social media and app stores.

What we found

  • Phishing websitesPages impersonating the programme to target its members
  • Fake appsLookalike apps posing as the official one
  • Scam adsAds using the brand to lure members to scam sites

Client name withheld to protect confidentiality.

Campaigns

One phishing site is rarely on its own.

Scammers reuse the same kit, hosting and registrar across dozens of sites. We link them into a single campaign, so you can see the whole operation and we can take it all down together.

  • The same phishing kit or page code
  • Shared hosting, IP addresses and name servers
  • The same registrar and registration patterns
  • Repeated wording and naming in the domains
Explore threat intelligence →
Campaign viewExample
1 CAMPAIGN Same phishing kit Shared hosting Same registrar
11linked phishing sites
3shared signals
1coordinated takedown

What's included

Everything you need to stop phishing, in one service.

CasesSearch…⌘K
←PH-2041P2Export Case Packet
https://solsticepay-verify.top/loginUnphishScan

Case status

Resolved

State: Closed

Verification history

DownDNS: ✕ | HTTP: ✕12 Aug 2026, 11:09
Desktop screenshotCaptured
Solstice PaySign in to your accountSign in
OverviewEvidence & AnalysisTimelineNotes

Description of abuse

Cloned login page targeting Solstice Pay customers at solsticepay-verify.top

Threat type
Phishing site
Category
Domains / Web
Detected
12 Aug 2026
Case age
2h to resolve

Outcome

Resolved

  • Screenshot evidence available
  • WHOIS/registrar evidence available

Add a comment

Add a comment for your enforcement team
Add comment

Illustration of the Unphish client portal with example data.

Lookalike domain monitoringNew registrations, certificates and DNS changes that use your name
Phishing site detectionAcross the open web, ads and search results
Phishing kit fingerprintingSpot the same kit wherever it's reused
AI-assisted analysisEvery threat risk-scored, then validated by an analyst before enforcement
Forensic evidenceTimestamped screenshots, source, DNS, WHOIS and SSL
One-click enforcementReviewed threats move straight into takedown, where configured
Takedown and escalationHost, upstream provider, CDN, registrar and registry, escalated if they don't act
Removal verifiedAutomated checks confirm the site is gone and flag it if it reappears
WatchlistParked lookalikes watched until they go live
Threat intelligenceRelated sites clustered into campaigns, so you can see who is behind them
Spotted one? Send it inIf your team or customers find a suspicious site, flag it and we'll take it from there
Reporting and audit trailDashboards, timelines, scheduled reports and a record of every action

Found a phishing site using your brand?

Request a takedown →

FAQ

Phishing protection questions, answered.

What is phishing protection?

Phishing protection means finding the fake websites, lookalike domains and cloned login pages that impersonate your brand, proving they're malicious and getting them taken offline before they reach your customers. Unphish does all three, then keeps watching in case they come back.

How do you take down a phishing website impersonating my brand?

We capture the evidence, confirm the site is malicious and send a takedown request to the hosting provider, registrar or platform. If they don't act, we escalate upstream to the provider, the CDN, the registrar and, if needed, the registry, and we track the case until the site is confirmed offline.

How long does a phishing site takedown take?

It depends on the host and registrar. Some act quickly and others need a push. If a host doesn't respond, we escalate to the next provider up the chain and keep going until the site is gone.

Do you watch lookalike domains before they go live?

Yes. We monitor new domain registrations, certificates and DNS changes, so a lookalike domain can be flagged and watched before it starts hosting a phishing page.

What if the phishing site comes back?

Cases are monitored after removal. If the site is re-hosted, moved to a new domain or copied by the same kit, we pick it up and act again.

Can we report phishing sites we find ourselves?

Yes. Your team can submit suspicious links at any time, and they go through the same evidence, validation and takedown process.

What evidence and reporting do we get?

Every case includes timestamped screenshots, page source, DNS, WHOIS and SSL records, and a full audit trail. Dashboards and scheduled reports show what was found, what was taken down and how long it took.

Spot the phish

How many red flags can you spot?

A customer gets a text saying their account is locked and taps the link. This is the page they land on. Tap everything that looks wrong.

  1. Spot
  2. Reveal
  3. Take down

Give it a go

0/6 found

Tap directly on the page below to flag anything that looks wrong.

Home Help Business

Verify your account

Confirm your details to restore access.

Email addressPasswordVerify now

We're here to help

Our team is available 24/7 if you need support with your account.

© 2026 Solstice Pay · Privacy · Terms

Found 0 so far. Keep looking.

Results

Phishing pages copy real branding and layouts. The giveaways are in the address, the pressure and what they ask for.

  1. 1
    Not the real addressSolstice Pay lives at solsticepay.com, not solsticepay-secure.net.
  2. 2
    The padlock proves nothingIt only means the connection is encrypted. Phishing sites get certificates too.
  3. 3
    Manufactured urgencyA 24-hour deadline is there to rush you before you think.
  4. 4
    Unlock what?An unlock button on arrival assumes a problem you never had.
  5. 5
    Asks for too muchNo login page needs your card number and CVV.
  6. 6
    Free email for supportA real company doesn't run support from a Gmail address.

Take it down

One phishing page usually means more than one thing to remove.

Phishing pageHosting takedown

The host is sent evidence and asked to remove the page, with escalation if they don't act.

Lookalike domainRegistrar suspension

The domain itself is suspended, so the page can't simply move to a new host.

Same kit elsewhereCampaign takedown

Sites built from the same phishing kit are linked and taken down together.

Before you enter anything, check the address, be wary of sudden requests to verify, and type the real website in yourself.

Liked that one? Follow us on LinkedIn for scam insights, research, takedown stories and company news.

Follow Unphish on LinkedIn

Keep exploring

Use caseTypes of phishing attacksHow phishing campaigns work and why brands are targeted → SolutionDomain ProtectionCatch lookalike domains before they're used → SolutionTakedownEvidence-backed enforcement across every channel → SolutionThreat IntelligenceSee the campaigns behind the sites →

See the phishing sites targeting your customers.

Book a demo, or start with a free scan of the lookalike domains and phishing sites already using your name.

Book a demoGet a free threat scan