Malte ZanderContents
A phishing campaign is a chain: a sender, a lure, one or more redirects, a landing page, a place where stolen data goes and finally the fraud itself. Each link is controlled by someone who can act, from the mail provider to the host and the bank. You cannot delete an email from inboxes, but you can close the sender account, break the redirect and remove the landing page, which makes the email harmless.
Which links make up a phishing chain?
Six, and most campaigns use all of them:
Sender: a spoofed address, a lookalike domain, a hacked account or a free webmail account.
Lure: the email, text, QR code or ad with a pretext such as a failed payment or a locked account.
Redirects: link shorteners, redirector pages or misused redirects on trusted sites, often with a filter that only lets targets through.
Landing page: the copy of your login, payment or verification page on a lookalike domain, a hacked site or a platform subdomain.
Data drop: where stolen data goes, such as an email inbox, a messaging bot, an admin panel or a live proxy.
Cash-out: account takeover, payment fraud or invoice fraud.
Who controls each link, and what can you do?
| Link | Who can act | What you do | Result |
|---|---|---|---|
| Sender | Mail provider; for your own domain, you | Report the sending account; enforce DMARC on your domain | Account closed; exact spoofing of your domain blocked |
| Lure | Recipients' mail providers, national services | Forward samples to provider reports and national services | Filters learn, warnings go out |
| Redirects | Shortener service or the site with the misused redirect | Report the short link; ask the site owner to fix the redirect | The entry link stops working for everyone |
| Landing page | Host, registrar, CDN | DSA notice to the host, abuse report to the registrar, CDN report | Page or domain removed |
| Browser layer | Google, Microsoft | Safe Browsing and Microsoft reports | Visitors see a warning |
| Data drop and cash-out | Platforms, banks, payment providers | Report accounts; alert banks when payments are involved | Accounts frozen, payments stopped |
The landing page is usually the strongest lever, because host and registrar can remove it for all recipients at once. All channels with links are in How to report a phishing website in Europe.
Why report the first link, not only the last?
Because the entry link is what sits in thousands of inboxes. If you only report the final page, the redirect in the email stays live and the attacker simply points it to a new page.
Report every hop: the short link, the redirector and the landing page. When the entry link dies, every copy of the email in every inbox becomes harmless at once.
Test with the exact link from the email. Many chains contain a gate that shows the fake only to the right device, country or link parameters. See hidden fakes.
What can you do about the sender?
It depends on who sent the email:
Your exact domain, spoofed: publish an enforced DMARC policy. Gmail already requires senders of more than 5,000 messages a day to publish a DMARC record and to align the From domain with SPF or DKIM (Gmail). Moving from a monitoring policy to enforcement is what blocks spoofing.
A lookalike domain: report the domain like a landing page, to registrar and host.
A hacked or free webmail account: report it to the mail provider. In invoice fraud, free webmail is common: 69% of business email compromise attacks in the fourth quarter of 2025 used free webmail domains (APWG).
What happens after the data drop?
The fraud, often within minutes. Microsoft saw payment fraud begin as little as five minutes after credentials and session cookies were stolen (Microsoft).
Invoice fraud is rising too. Wire transfer attacks of this kind grew by 136% from the third to the fourth quarter of 2025, with an average requested amount of $50,297 (APWG). That is why account protection runs in parallel with the takedown, as described in why two-factor login doesn't stop every phishing page.
What evidence do you keep for each link?
Sender: the full email with headers, including the authentication results for SPF, DKIM and DMARC.
Lure: a screenshot of the message and the original link exactly as it appears.
Redirects: every address in the chain, in order, with the time of the test.
Landing page: full URL, screenshots, hosting, DNS and certificate data.
Fraud: account changes, payment details and dates, for banks and police.
Our evidence guide explains how to keep each item credible.
Start the free fraud scan to find lookalike domains and cloned pages before they are linked in the next campaign. You get a short report within 48 hours.
FAQ
Can a phishing email be taken down?
Not from inboxes. But you can close the sender account, break the redirect and remove the landing page. Then the email leads nowhere.
Why does a phishing link still work after the page was removed?
The link probably points to a redirect that now leads to a new landing page. Report the first hop as well.
What do email headers tell you?
Which servers sent the message and whether SPF, DKIM and DMARC passed. That shows whether your domain was spoofed or a lookalike or hacked account was used, and which provider to contact.
Should we block lookalike domains internally?
Yes, in mail and web filters, as soon as you find them. That protects your staff while the external reports are processed.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Microsoft Security: AiTM phishing sites as entry point to financial fraud, 12 July 2022