Why Unphish

We see every threat through to takedown.

Unphish finds the scams using your name, proves them and keeps escalating until they're offline, across websites, domains, social media and app stores.

Phishing websites
99%
taken offline
Fake social accounts
99%
removed on Facebook, X and Instagram
Analyst checked
100%
of cases checked by an analyst before a takedown is sent
Reach
100+
platforms and domain extensions we've enforced takedowns on
FacebookX.com.top.shopand more

Source: Unphish closed cases, Jan–Jun 2026

BackedBacked by the Australian Government

Developed with support from the Industry Growth Program

VerifiedAnalyst-verified takedowns

Every threat is checked by an analyst before it goes to takedown

GlobalAustralian-built, globally trusted

Sovereign capability, protecting organisations in Australia, the US and the UK

GlobalTrusted around the world

Protecting organizations in the US, the UK and Australia

GlobalTrusted around the world

Protecting organisations in the UK, the US and Australia

ExpertDomain and DNS experts

Deep experience across registrars, hosting providers and brand protection

ExpertDomain and DNS experts

Deep experience across registrars, hosting providers and digital risk protection

The results

Measured on real cases.

Every number on this page comes from takedown cases we closed for our clients in the first half of 2026.

Success rate

Takedown success by threat type

Share of the threats we pursued that were suspended or removed

100%

Compromised websites

99%

Phishing websites

98%

Fraud and fake payment sites

98%

Fake social media accounts

98%

Fake shops

Social media figure covers Facebook, X and Instagram.

Quality

Reports that hold up

How our takedown requests fared with the platform, registrar or host

99%

of takedown requests were acted on by the platform or provider

Acted onProvider's policy call

More than 99 in 100 were acted on. Each request is backed by evidence the provider can act on.

Source: Unphish takedown cases opened January to June 2026.

Case studies

What we find when we start looking.

Results from three specific client engagements.

Case study

Global testing provider · 4-week trial

12/12

enforcement actions succeeded

  • 365 threats found across 7 platforms
  • 2 hours for the fastest takedown
  • Fake certificates, leaked exam content and impersonation, handled end to end with minimal client effort
Case study

Airline loyalty programme · first sweep

250+

malicious and suspicious instances found

  • Across the open web, social media and mobile app stores
  • Phishing sites, fake apps and scam ads targeting members
Case study

Airline group · cold sweep

72 hrs

to surface live threats, using only the brand name

  • Cloned booking websites
  • Fake apps on third-party APK marketplaces
  • Fake support accounts and YouTube channels pushing scam phone numbers

Figures are from individual client case studies. Client names withheld to protect confidentiality.

What makes us different

Built to find and remove threats.

01 · Detection

Five layers of detection. A person checks every case.

Keyword alerts miss the clever scams and flood you with noise. Every signal we collect passes through rules, machine learning and AI reasoning that judges context the way an analyst would. Then a security specialist validates it before anything is enforced, and their decision trains the models.

01CollectDomains, certificates, feeds, ads, social and app stores
02RulesHeuristics strip out the obvious noise
03Machine learningVisual and text models score every signal
04AI reasoningJudges context the way an analyst would
05Analyst checkA person validates before we act
Confirmed threat, ready to take down
Platform or hostEvidence-backed takedown notice
Upstream providerNo response? We go above the host
CDNCut off the service shielding the site
RegistrarSuspend the domain itself
Registry and ICANNThe last resort, when others won't act
Confirmed offlineTracked, closed and watched for a comeback

02 · Enforcement

We don't send one notice and hope.

If a host ignores a takedown request, we go upstream to the provider, the CDN, the registrar and, if needed, the registry and ICANN. We have direct relationships with registrars, hosting providers, app stores and social platforms, and we track every case until it's confirmed offline.

03 · Infrastructure

Rooted in domains and DNS.

Our background is in domain and DNS infrastructure as well as brand monitoring. We know where scammers register, how they host and how they reuse kits, so we can find the network behind a scam and take down the whole campaign.

From our case data

Where the phishing sites we took down were registered

Share of phishing websites by domain extension. Box size shows share.

.com21%
.top18%
68 others28%
.shop10%
.click9%
.cc4%
.net4%
.ru3%
.info3%

Phishing sites alone used 76 different extensions. Cheap newer ones like .top, .shop and .click are now nearly as popular with scammers as .com.

Campaign viewExample
1 CAMPAIGN Shared hosting Same phishing kit Same registrar
11linked sites
3shared signals
1coordinated takedown

04 · Intelligence

See the whole campaign behind every case.

Scammers rarely run one site. We group related threats by shared hosting, phishing kits, registrars and lookalike names, then take the whole network down together. Reporting shows where attacks come from, which providers act fastest and what keeps coming back.

The platform

One platform. The whole threat lifecycle.

Evidence is gathered automatically, AI scores every threat and recommends an action, and your analyst stays in control. Where you allow it, approved threats go straight to enforcement in one click.

Threat FeedSearch…Solstice PayES
OverviewEnforcementThreat GraphThreat Feed90 daysAll ClientsAll Assets
ThreatChannelAI confidenceStatus
solsticepay-verify.topPhishing site96%Offline
@SolsticePayHelpFake social account92%Removed
Solstice Pay Wallet (APK)Fake app88%Takedown sent
solstice-pay.clickLookalike domain81%Escalated
“Solstice Pay rewards” adScam ad77%In review

Evidence captured automatically

ScreenshotsPage sourceDNSWHOISSSLRedirect chainDeveloper details

Recommended action

Enforce

Illustration with example data.

See it in action

What you get

A team behind every takedown.

People

A named team that knows your brand

A dedicated account lead and enforcement lead from day one, with proactive updates on every case.

Response

24/7 emergency hotline

Under active attack at 2am? Call us. Urgent cases are escalated straight away.

Evidence

Forensic evidence on every case

Timestamped, hashed screenshots, page source, DNS, WHOIS and SSL records, ready for legal, audit or regulators.

Visibility

Live dashboard and reporting

See every threat, case and outcome in one place, with scheduled reports and a full audit trail.

Commercials

Clear pricing with no setup fees

Plans with unlimited takedowns and onboarding included, so your cost is predictable.

Reliability

99.9% uptime SLA

Monitoring runs around the clock, with an open API to send cases into the tools your team already uses.

Australia · Scams Prevention Framework

Ready for the Scams Prevention Framework.

The SPF asks regulated businesses to prevent, detect, disrupt and report scams. Unphish does the work and keeps the evidence, with a full audit trail for every detection and takedown.

How Unphish supports the SPF →
01PreventFind lookalike domains and fake accounts before they're used
02DetectMonitor web, social, apps and ads around the clock
03DisruptTake threats down and escalate until they're offline
04ReportEvidence and audit trails ready for regulators

How we compare

More than a monitoring tool.

Here's how Unphish stacks up against a typical monitoring-led vendor and handling takedowns yourself.

Monitoring-led vendorDoing it in-house
Finds threats and takes them downYesSometimesSlowly
A person validates every case before enforcementYesVariesYes
Escalates to upstream hosts, CDNs, registrars and ICANNYesOften one noticeRarely
Websites, domains, social media and app stores in one placeYesPartialSeveral tools
Forensic evidence pack on every caseYesScreenshotsManual
Named account team and 24/7 hotlineYesTicket queueYour team's time
Plans with unlimited takedowns and no setup feesYesCredit packsStaff cost

FAQ

Questions buyers ask us.

What makes Unphish different from other brand protection providers?

Every threat goes through five layers of detection and a human analyst check, then we take it down and keep escalating to upstream hosts, registrars and platforms until it's offline. Websites, domains, social media, apps and ads are all handled in one platform.

How quickly can you take a threat down?

It depends on the platform, registrar or host. Some act quickly and others need a push, so we escalate through other contacts when a provider is slow. Every case is tracked in the portal until the threat is confirmed offline.

What can Unphish take down?

Phishing and fake shop websites, lookalike domains, compromised websites, fake social media and messaging accounts, executive impersonation, fraudulent mobile apps and scam ads.

Do you need access to our systems?

No. We monitor the public internet, social platforms and app stores. We just need your brand names, official domains and accounts so we can tell what's real and what's fake. An API is available if you want cases sent into your own tools.

How quickly can we get started?

Detection can be live within two weeks, with a named account team guiding you through onboarding.

How is Unphish priced?

We offer plans with unlimited takedowns and no setup fees, so your cost is predictable. Book a demo and we'll recommend the right plan for the channels you need to protect.

Do you work with UK organisations?

Yes. Unphish protects organisations in the UK, the US and Australia. We take down threats wherever they're registered or hosted.

“

When our company faced a serious cybersecurity threat, Unphish proved to be exactly the partner we needed. Their responsiveness and commitment made them an invaluable cybersecurity partner.
CFO, major e-commerce company

See what's targeting your brand.

Book a demo, or start with a free scan of the threats already using your name.