Phishing

How it works

A typical campaign sends an urgent message by email, SMS, social DM, or ad that links to a lookalike page asking the victim to "verify", "log in", or "pay". The page captures whatever is entered and forwards it to the attacker.

Phishing has many variants by channel and target, including spear phishing, smishing, QR phishing, whaling, and reverse-proxy phishing that defeats MFA.

How it relates to brand impersonation

Phishing is brand impersonation operationalized for theft. The page or message almost always wears a real brand to borrow its trust. The infrastructure behind it, including domains, hosts, and kits, is exactly what monitoring and takedowns target.

How nebty helps

nebty detects phishing infrastructure impersonating your brand and takes it down on demand, billed on success, so you only pay once the page is removed. Learn more on our phishing protection page.

How to recognise a phishing attempt

Most phishing shares a handful of tells. There is manufactured urgency: a deadline, a threat of suspension, a payment that must happen now, designed to push you past your judgement. There is a mismatch between the display name and the actual address or link, visible when you hover or expand it. There is a request that does not fit the channel, like a bank asking you to confirm a password by email. And there is a link to a domain that is close to but not exactly the real one. On a phone these are harder to catch because the address bar and link previews are truncated. The reliable habit is to stop on any unexpected, urgent message and reach the organisation through a channel you already trust rather than the one the message hands you.