Threat intelligence
Find the people behind the fakes.
One fake site is a case. Fifty on the same servers, built from the same kit, is a campaign. Unphish links related threats by what scammers reuse, profiles the groups behind them and shows which campaigns are active, so you can take down the whole operation at once.
How it works
Single cases add up to whole campaigns.
Every case adds to what we know. Shared servers, kits and lures connect new threats to old ones, so patterns that would stay hidden case by case become clear.
The results
Intelligence that leads to takedowns.
From cases we linked and closed for our clients in the first half of 2026.
What's included
Everything you need to see the bigger picture.
FAQ
Threat intelligence questions, answered.
What is threat intelligence at Unphish?
It's what we learn by connecting threats to each other. Instead of treating every fake site or account as a separate case, Unphish groups related threats into campaigns, profiles the groups behind them and tracks how each campaign changes over time, so you can act on the whole operation.
How do you group threats into campaigns?
By what scammers reuse: IP addresses, registrars, hosting networks, certificates, phishing kit templates, image and favicon files, phone numbers, payment details and wording. Each campaign shows the shared evidence that links its members, so you can see why they belong together.
What happens when a campaign comes back?
We remember it. When a new site or account turns up with the same fingerprint, like the same kit, favicon file, hosting or phone number, it's linked to the existing campaign as soon as it's found. It goes straight into the same takedown process, so your team doesn't start from scratch.
What are tracked actors?
Profiles of the groups behind repeat campaigns: how they host, what tools they use, who they target and which cases they're linked to. They're built and checked by our analysts and never created automatically, and each is rated by severity.
How does intelligence help with takedowns?
You can send every open threat in a campaign to enforcement at once, where configured. We know which platforms, hosts and registrars act on reports and which need escalating, and new sites that match a known campaign are linked as soon as they're found.
Is the intelligence based on real case data?
Yes. Campaigns, summaries and timelines are built from the cases we handle and the evidence behind them. Timelines show the date each threat was detected, and every campaign links back to its member cases.
Can we share intelligence with our team?
Yes. Campaigns and reports can be exported, and scheduled reports keep security, fraud and brand teams up to date. Every detection and takedown is recorded, giving you a complete audit trail.
Does Unphish help with UK scam and fraud rules?
Yes. Unphish helps UK organisations detect, disrupt and document impersonation, with a full audit trail of every detection and takedown. That record supports your work under the Online Safety Act and APP fraud reimbursement rules.
See where your brand is being abused.
Run a free threat scan or book a demo to see what's targeting your customers right now.