Most scam pages show a harmless decoy to security scanners and reveal the real trap only to victims in the target country. Phishline reproduces them from inside that country and publishes what it finds — so people can check before they click, and brands can see what they're missing.
Our listings are temporarily offline while every entry is re-verified against a stricter standard (domain ownership, parked/for-sale detection, and manual review). We would rather show nothing than name a legitimate site. Addresses are shown "defanged" (with the dot in brackets) so they're safe to read and can't be clicked by accident. If a site you were sent is on this list — or looks like one of these — don't enter anything.
"Defanged" means bitsox[.]com instead of the live address — readable, unclickable. This is a sample of the live database; the full set updates continuously.
Extra letters, a swapped character, or a different ending: bitsoz[.]com, paytm-wallet[.]com. Real logins live on the brand's exact domain.
"Your account will be locked", "verify in 10 minutes". Urgency is the scammer's main tool — it stops you checking the address.
No real wallet, bank or exchange ever asks for your 12-word recovery phrase or full card PIN on a web page. Ever.
A link from a search ad, a message or a support "agent" is far riskier than typing the address yourself. Type it yourself.
Modern fakes are pixel-copies of the real site. Looking right proves nothing — only the address in the bar does.
We verify it, capture the evidence, and report every confirmed page to Google Safe Browsing and the brand being impersonated — free, and whether or not you're a customer of anyone. The faster it's reported, the fewer people it can hurt.
If your login page is worth copying, someone is copying it. The problem isn't finding look-alikes — it's that the dangerous ones cloak: they serve a clean page to your security tools and the scanners you pay for, and the real credential-stealing page only to your customers. Here's what that looks like across the brands we watch.
Phishing kits fingerprint every visitor. A datacenter IP — which is what almost every scanner uses — gets a harmless decoy or a 404. A real phone on a home connection in the target country gets the fake login. We reproduce the victim's exact view with a real browser on an in-country residential connection, and screenshot the page your tools will never see.
Per-brand figures are being re-verified and will return once every entry passes ownership and manual review.
New domains and TLS certificates are checked against every brand we monitor the moment they appear — before the scam goes live.
Obvious look-alikes are filtered from datacenter first, so expensive checks only run on real suspects.
Survivors are opened with a real browser on a residential connection in the target country — defeating the cloak.
We capture the live page, hosting and registrar, package it, and report confirmed sites to Google and the brand.
Tell us your brand. We'll run it and send back a free evidence pack — real fake pages, screenshotted from your customers' point of view. No pitch, no obligation.