Phishing

Types of phishing attacks, and how to spot them.

Phishing is when criminals pretend to be a brand people trust to steal their logins, card details or money. Here's how the attacks work, what they look like and how organisations shut them down.

See phishing protection Request a takedown

Anatomy of a phishing linkExample

1
The padlockOnly means the connection is encrypted. Phishing sites get certificates too.
2
Your brand, out frontThe brand name is just a label on someone else's domain.
3
The real domainThe part that matters. A cheap ending, often registered days ago.
4
The trapA copy of the real sign-in page, built to capture logins and codes.

Tap a part of the link to see what it means.

What is phishing?

A fake version of you, built to steal.

Phishing is a type of fraud where criminals impersonate a trusted organisation to trick people into handing over passwords, card numbers or one-time codes. It doesn't exploit a weakness in your systems. It exploits the trust people have in your name.

solsticepay-rewards.topRegistered today

/login/verifylogo.png

Set up

A copy of your site goes up.

The attacker registers a lookalike domain, or breaks into a real website, and uploads a phishing kit: a ready-made copy of your login page, logo and wording. Kits are sold online, so this can take minutes.

Solstice PayYour 84,000 points expire tonight. Redeem now: solsticepay-rewards.top

Lure

A message sends people to it.

Links go out by text, email, social posts, paid ads or QR codes. The message gives a reason to act now: points about to expire, a locked account, a refund waiting or a parcel on hold.

Sign injess@email.com••••••••••

482916

Continue

Hook

They type in their details.

The page looks right, so people sign in. Many kits then ask for a card number or the one-time code just sent to their phone, which lets the attacker get past two-factor security in real time.

New device signed inPoints redeemed: 84,000

Card ending 4417$1,280.00 · Online purchase

Cash out

The account is emptied.

Stolen details are used straight away to drain balances, spend points or buy gift cards, or sold to other criminals. When the site gets reported, the same kit is moved to a new address.

Types of phishing attacks

Nine ways phishing reaches your customers.

Most campaigns mix several of these. A text message points to a lookalike domain, which hosts a cloned login page. Pick one to see how it works.

solsticepay-signin.top/login

Website phishing

A copy of a real login, payment or account page, hosted somewhere the attacker controls. Almost every phishing attack ends here, whatever channel it starts on.

How it works: the page is cloned from the real site, often with a phishing kit that also forwards what people type to the attacker straight away. Some kits block security scanners and only show the fake page to real visitors.

Watch forWrong domainAsks for card or one-time codeUnusual ending

Phishing Protection →

Realsolsticepay.com

Fakeso1sticepay.com

Fakesolsticepay.shop

Fakesolstice-pay-au.com

Lookalike domain phishing

Domains built to pass a quick glance: a swapped letter, an extra word, a hyphen or a different ending.

How it works: attackers register dozens of variations at once, often parking them until a campaign starts. Some use characters from other alphabets that look identical to Latin letters.

Watch forSwapped lettersExtra words like secure or auNew endings

Domain Protection →

Messages

SolsticePayYour account has been locked after an unusual sign-in. Verify within 24 hours to avoid suspension: solsticepay.verify-id.top

Text message · Today

Smishing

Phishing by SMS. Short, urgent and sent in bulk, often with the brand name as the sender.

How it works: sender names can be spoofed, so a fake text can land in the same thread as real ones from your brand. The link opens a phishing page built for mobile, where the address bar is easy to miss.

Watch forDeadlinesShort or odd linksRequests to verify

Smishing and vishing →

SSolstice Pay SecurityIncoming call

"We've stopped a suspicious payment. To cancel it, read me the code we just sent you."

Vishing

Voice phishing. A phone call or voicemail from someone claiming to be your bank, a retailer or a support team.

How it works: callers spoof the caller ID and use details from earlier breaches to sound genuine. Often it follows a fake text, or a customer calls a fake support number they found online.

Watch forAsks for codes or passwordsPressure to act nowAsks to move money

Smishing and vishing →

Parking noticeUnpaid fee: $45.00. Scan to pay today and avoid a fine.

Quishing

Phishing with a QR code. The link stays hidden until someone scans it with their phone.

How it works: codes are stuck on parking meters, posters and flyers, or sent in emails and letters. Because there's no visible link, people and email filters have nothing to check before it opens.

Watch forStickers over codesPayment requestsCodes in unexpected emails

Smishing and vishing →

From Accounts <billing@solsticepay-invoices.com>To Sam, FinanceSubject Re: Invoice 4471 overdue

Hi Sam, as discussed with Priya, please process the attached today. Our bank details have changed, see page 2.

Spear phishing

A message written for one person or team, using real names, projects and suppliers to seem routine.

How it works: attackers research targets on LinkedIn and company websites, then send something that fits their day. Common goals are logins to business systems or a change to payment details.

Watch forChanged bank detailsLookalike senderUnusual urgency

Domain Protection →

Chris Taylor, CEOWhatsApp · new number

Are you free? I need you to handle an urgent transfer before the board call. Keep this between us for now.

Whaling

Spear phishing aimed at senior leaders, or pretending to be one, to get staff to act without checking.

How it works: a fake profile or new number uses an executive's name and photo. The request is urgent and confidential so people skip the usual approvals.

Watch forNew number or accountSecrecyGift cards or transfers

Executive Impersonation Protection →

Jess M@SolsticePay my payment's been stuck for 3 days, no one is answering!!

Solstice Pay Help @SolsticePay_HelpSorry to hear that Jess. DM us your account email and we'll fix it now.

Social media phishing

Fake support accounts, pages and posts that use your name to reach customers where they already talk about you.

How it works: fake support accounts watch for complaints, reply first, then move the chat to private messages or a phishing link. Fake pages also run giveaways that collect logins.

Watch forExtra words in the handleMoving to DMsGiveaways

Social Media Brand Protection →

solstice pay login

SponsoredSolstice Pay | Official Loginsolsticepay-login.click

Solstice Pay: Sign insolsticepay.com

Search and ad phishing

Paid ads and planted search results that put a fake site above the real one when people search for your name.

How it works: the ad shows reviewers a harmless page and real visitors the phishing page. Scammers also plant fake support numbers in files on trusted websites so they rank in search.

Watch forSponsored resultsOdd domain under the titleSupport numbers in documents

Ad Fraud Protection →

In the data

What phishing looks like right now.

Patterns from the phishing websites we took down for our clients in the first half of 2026.

80%

of phishing sites were registered on an ending other than .com

66%

had a padlock (HTTPS), so it's no sign a site is safe

23%

put the brand name in front of someone else's domain

37%

didn't use the brand name in the web address at all

Where the brand name sat in the web address

In the domain namesolsticepay-rewards.top36%
In front of another domainsolsticepay.redeem-gift.top23%
Misspeltso1sticepay.shop5%
Not in the address at allpoints-centre.click37%

Checking for your brand name in a domain catches less than two thirds of these sites. The rest only show your brand once the page loads.

Source: Unphish phishing website cases opened January to June 2026. Example addresses are illustrative. Figures are rounded.

Why brands are targeted

Your name does the convincing.

Phishing doesn't need a weakness in your systems. It borrows the trust people already have in you, and the cost lands on you either way.

Customer fraud

Stolen logins, card details and one-time codes lead to drained accounts, spent points and payments sent to the wrong place.

Damaged trust

People remember where they were scammed. A fake site with your logo makes them warier of your real messages too.

Cost and scrutiny

Support calls, refunds and fraud investigations add up, and regulators increasingly expect organisations to act on scams that use their name.

$97.6m

reported lost to phishing in Australia in 2025

Source: National Anti-Scam Centre, March 2026

Campaigns

One phishing site is rarely on its own.

Scammers reuse the same kit, hosting and registrar across dozens of sites. We link them into a single campaign, so you can see the whole operation and we can take it all down together.

The same phishing kit or page code
Shared hosting, IP addresses and name servers
The same registrar and registration patterns
Repeated wording and naming in the domains

Explore threat intelligence →

Campaign viewExample

11linked phishing sites

3shared signals

1coordinated takedown

Use case

How teams use Unphish to stop phishing.

Phishing lands on several desks at once. Unphish finds the sites, proves they're malicious and gets them taken down, so no one has to chase hosts and registrars.

See Phishing Protection →Book a demo

Fraud and risk

Fewer account takeovers and less money lost.

We take phishing sites down before more customers hand over logins, cards and codes.

Security

Threats outside the network handled, without more manual work.

We monitor beyond your network, check the evidence and run takedowns end to end.

Customer support

Fewer "I think I've been scammed" calls.

We flag live campaigns early, so agents know what customers are seeing.

Brand and digital

Customers who trust the messages and links they send.

We find and remove fakes of your website, app and campaigns.

In practice

A copy of your login page goes live on a lookalike domain.

What Unphish doesWhat your team sees

01
Spotted
A new certificate is issued for solsticepay-rewards.top and the page copies your sign-in. It's picked up and scored.
Sees an alert in the Threat Feed.
02
Checked
An analyst confirms it's phishing and captures screenshots, page source, hosting and registration details.
Gets the evidence pack and approves enforcement in one click.
03
Taken down
Evidence-backed reports go to the host and registrar, escalated until the site is offline.
Follows live status in the Enforcement Centre. No emails to send.
04
Linked
Sites sharing the same kit, hosting or registrar are grouped into one campaign and taken down together.
Follows the whole campaign behind dozens of sites.
05
Reported
Removal is verified and the domain is watched in case the site comes back.
Gets reporting for risk, fraud and leadership.

Case study · Airline group

99%

of the phishing sites targeting the airline's customers were confirmed taken down between January and June 2026.

Most copied the loyalty programme's sign-in or offered points that were about to expire. As soon as one went down, the next appeared somewhere new.

See Phishing Protection →

84%

Weren't on .comThey were spread across dozens of other endings, so watching one or two would have missed most of them.

69%

Used points as the baitRewards, gift cards and frequent flyer points were the most common hooks.

Spike caught in JuneVolume doubled between May and June, and the new sites were picked up and pursued the same way.

Client name withheld to protect confidentiality.

Jargon, decoded

The phishing terms worth knowing.

The words security teams use, in plain English.

Phishing kit: A ready-made package of fake pages and scripts, sold online, that copies a brand's login and sends stolen details to the attacker.
Credential harvesting: Collecting usernames, passwords and codes through a fake page. The main goal of most phishing sites.
Typosquatting: Registering a domain that's one typo away from the real one, to catch people who mistype or misread it.
Homoglyph: A character that looks like another, such as a Cyrillic "а" in place of a Latin "a", or the number 1 in place of an l.
Cloaking: Showing a harmless page to security scanners and ad reviewers, and the phishing page only to real visitors.
Real-time relay: A kit that passes what the victim types straight to the real site, so the attacker can use a one-time code before it expires.
Lure: The message or ad that gets someone to click: an expiring reward, a locked account or a refund waiting.
Takedown: Getting the host, registrar or platform to remove a phishing site or account, backed by evidence that it's malicious.

Warning signs

How to tell a phishing site from the real thing.

A real-looking example

SolsticePayYour points expire tonight at midnight. Redeem them now: solsticepay.rewards-au.top35

solsticepay.rewards-au.top/redeem12

Solstice Pay Rewards

Confirm your details to redeem 84,000 points

Email addressPassword

Card numberOne-time code4

Redeem now

Help: solsticepay.rewards@gmail.com6

1
The domain isn't the brand'sRead the part just before the first single slash. Here it's rewards-au.top. The brand name in front is just a label.
2
An unusual ending.top, .shop, .click and .cc are cheap, quick to register and common in phishing.
3
A deadlineUrgency is there to stop people checking. Real brands rarely give hours to act.
4
It wants more than a loginA card number or one-time code on a sign-in or rewards page is a big red flag.
5
The link came to youSafer to open the app or type the address than tap a link in a message.
6
Details that don't add upFree email addresses, odd wording or a reward that's too generous.

Checklist for your team

Phishing site targeting your customers? Here's what to do.

The sooner a site is reported, the fewer people see it.

0 of 5 done

Tap each step to tick it off.

If a customer lost money, they can report it

Scamwatch ↗ReportCyber ↗IDCARE ↗

Want us to handle it? Request a takedown →

For your customers

Give your customers a head start.

Two short notes you can adapt for your website, app, emails or support replies. One helps customers spot a fake before they click. The other tells them what to do if they already have.

The copied version leaves blanks for your brand name and official details.

Solstice PayStaying safe

How to spot a fake Solstice Pay message

We'll never ask for your password or one-time code by text, email, phone or social media.
Our only website is solsticepay.com. Check the part just before the first single slash.
We don't give you hours to act. Messages about expiring points or locked accounts are a red flag.
Our support accounts are verified. We'll never move your chat to a private message or another app.
Not sure? Open the app or type the address yourself instead of tapping a link.

Seen something suspicious? Report it at solsticepay.com/report

Example

Solstice PayHelp centre

Clicked a link that looked like it was from us?

Close the page and don't enter anything else or reply to the message.
Change your password in the Solstice Pay app, and anywhere else you use it.
Call your bank on the number on your card if you entered card details.
Check your account for new devices, payees or changed details, and turn on two-step login.
Ignore follow-ups offering help. Contact us on 1300 000 000 or at solsticepay.com/help.

We'll never call to ask for a one-time code.

Example

How Unphish stops it

Get the fake site taken down.

Unphish finds the lookalike domains, cloned pages, ads and accounts using your brand, proves they're malicious and gets them removed at the source. Then we keep checking they don't come back.

Every case checked by an analyst before a takedown is sent
Escalated to the host, registrar and registry until it's gone
Related sites linked, so whole campaigns come down together

See phishing protection →

Case · Phishing websiteExample

solsticepay.rewards-au.top/redeem

Solstice Pay Rewards

Confirm your details to redeem 84,000 points

Email addressPasswordRedeem now

Taken down

DetectedNew certificate on a lookalike domain
Evidence capturedScreenshots, page source, hosting and WHOIS
Confirmed by an analystCloned login page, matches a known kit
Takedown sentEvidence-backed request to the host
EscalatedNo response, so on to the registrar
Offline and watchedRemoval verified, re-hosting monitored

FAQ

Phishing questions, answered.

What is phishing?

Phishing is a type of fraud where criminals pretend to be a trusted organisation to trick people into giving away logins, card details, one-time codes or money. It usually starts with a message or ad that links to a fake website made to look like the real one.

What are the most common types of phishing attacks?

Website phishing with cloned login pages, lookalike domain phishing, smishing (text messages), vishing (phone calls), quishing (QR codes), spear phishing and whaling (targeted messages to staff and executives), social media phishing and search ad phishing. Most campaigns combine several of these.

What's the difference between phishing, smishing and vishing?

They're the same trick on different channels. Phishing is the umbrella term and often means email or fake websites. Smishing arrives by text message, and vishing happens over the phone. Many smishing and vishing attacks still send people to a fake website in the end.

How can I tell if a website is a phishing site?

Check the real domain, which is the part just before the first single slash. Watch for a brand name placed in front of someone else's domain, unusual endings like .top or .shop, spelling tricks, urgent warnings, and login pages that also ask for card details or one-time codes. A padlock on its own doesn't mean a site is safe.

Why do phishing sites have a padlock?

A padlock only means the connection is encrypted. Certificates are free and quick to get, so phishing sites use them too. Two in three of the phishing sites we took down in the first half of 2026 used HTTPS.

What should we do if we find a phishing site using our brand?

Don't enter any details. Save the link and a screenshot, then report it to the hosting provider and registrar, or request a takedown and our team will check it, capture the evidence and handle the reports. If it's being actively shared, let your customers know what to look out for.

How can organisations protect customers from phishing?

Watch for new lookalike domains, certificates, ads and accounts using your name, act on the ones that are malicious, and check that removed sites don't come back. Clear guidance helps too, such as telling customers you'll never ask for passwords or one-time codes by text.

By industry

Phishing in your industry.

Every sector gets its own lures. See the phishing attacks we find and take down in yours.

Banking and Financial Services

Cloned internet banking logins and fake fraud alerts.

Fintech

Fake wallet sign-ins and payment verification pages.

Crypto

Wallet drainers and fake exchange logins.

Retail and E-Commerce

Fake order updates, refunds and gift card offers.

Airline and Transport

Loyalty points and booking change lures.

Lottery and Gambling

Fake bonus offers and cloned account logins.

Public Sector and Government

Fake tax refunds, fines and toll notices.

Non-Profit Organisations

Fake donation pages and impersonated appeals.

Film and Entertainment

Fake streaming logins and ticket offers.

Keep exploring

SolutionPhishing ProtectionFind phishing sites using your brand and take them down → SolutionDomain ProtectionCatch lookalike domains before they're used → SolutionTakedownEvidence-backed enforcement across every channel → SolutionSocial Media Brand ProtectionFake support accounts and impersonators →

Try it

Real or phish?

Five links that say they're from Solstice Pay, our example brand. Its real website is solsticepay.com. Which ones would you trust?

The quickest check: find the real domain, the part just before the first single slash. If it isn't exactly the brand's own, don't sign in.

How we take them down →

Found a phishing site using your brand?

Send us the link and our team will check it and talk you through taking it down. Or book a demo to see how we find them first.

Book a demo Request a takedown