Sharklio Phishing Emails: How to Spot a Fake

How do you spot a Sharklio phishing email?

A real Sharklio email comes from noreply@sharklio.com, links only to sharklio.com or docs.sharklio.com, and never asks you to reply with your password, a login code, or a wallet seed phrase. Sharklio code emails contain a 6-digit code to type on a page you opened yourself, not a button that logs you in. If an email pushes you to log in through its link, confirm a payout address you did not change, or pay to release earnings, treat it as phishing: do not click, open sharklio.com yourself, and report it.

This guide shows the real addresses and emails, the tricks fake ones use, and what to do if you already clicked. For the settings that protect your account, see Secure your Sharklio account.

The email addresses Sharklio really uses

Every email the Sharklio platform sends, from login codes to replies to your support messages, has the sender name Sharklio and the address noreply@sharklio.com. These are all the addresses you will see from us:

The part after the @ is always exactly sharklio.com. Not sharklio-support.com, not sharklio.net, not a Gmail or Outlook address, and not a name like “Sharklio Payouts” in front of some other address. The sender name is free text that anyone can type, so read the address itself.

What real Sharklio emails contain

Most Sharklio emails are triggered by something you just did. That is the best test: if you did not just ask for a code, a code email is a warning, not a request.

Code emails

Each one starts with the code in the subject line, so you can recognize it at a glance:

Inside, a real code email greets you by your username, shows a 6-digit code, says it expires in 15 minutes and can be used once, and tells you what to do if it was not you. The payout method email also shows the method and address the code will confirm. None of them has a button that logs you in or a form to fill in. The only links are the Sharklio logo (to sharklio.com), the social icons, and Contact us in the footer.

Notice emails

After a change, Sharklio emails you a notice, such as “Your Sharklio password was changed”, “Your Sharklio email address was changed” (sent to your old address) or “Your Sharklio payout method was changed”. Notices can have one button, and it points to a page on sharklio.com, such as your Account page. The same changes also appear under the bell icon in your dashboard, which is the safest place to check them.

What Sharklio never asks for

• Your password. Sharklio’s Privacy Policy says passwords are stored only as one-way hashes, so the team cannot see yours and has no reason to ask for it. You type it only on sharklio.com/login.
• A code by reply, chat or phone. Codes are typed on the Sharklio page that asked for them. The login code email says it plainly: if this was not you, do not share this code with anyone.
• A wallet seed phrase or private key. To pay you, Sharklio needs only a payout address, which you enter yourself in the Payout method card. Nobody who asks for a recovery phrase is helping you get paid.
• A payment to release your earnings. Creating an account is free. Under Sharklio’s Terms, a negative balance is offset against your future earnings in your account, not paid by transfer, so an email asking you to send money, crypto or gift cards to “unlock” a payout is a scam.
• Your app’s secrets in an email. Keep your API key and link hash salt in your dashboard and on your server. Keep your app secret safe explains why.

How to check links and the sender

Log in only on sharklio.com

Your dashboard and its login page live on one address: sharklio.com/login. Docs are on docs.sharklio.com, the offerwall on wall.sharklio.com, and the APIs on api.sharklio.com, but none of those pages ask for your Sharklio password. The only other sign-in screens are Google’s (accounts.google.com) and Discord’s (discord.com), and you reach them by clicking Google or Discord on the Sharklio login page, as Log in with Google or Discord shows. The habit that beats almost every phishing email: type sharklio.com yourself or use a bookmark, and never log in from an email link.

Read the real link before you click

On a computer, hover over a link and read the address that appears at the bottom of the browser or mail window. On a phone, press and hold the link to preview it without opening it. Read the domain from right to left, ending at the first single slash. Lookalike tricks to watch for (made-up examples):

• Swapped characters: sharkl1o.com, sharklia.com, or a letter from another alphabet that looks like a Latin one.
• Extra words: sharklio-payouts.com or sharklio-support.net. Sharklio uses only sharklio.com and its subdomains.
• Subdomain tricks: sharklio.com.account-verify.net belongs to account-verify.net, not to Sharklio.
• Hidden destinations: link shorteners and buttons whose text says sharklio.com while the real link goes elsewhere.

Check the sender in your mail app

Sharklio publishes SPF and DMARC records for sharklio.com, which help mail providers flag messages that fake our address. You can check a message yourself. Google’s Gmail help page on authenticated messages says to click the Down arrow below the sender’s name and look for “Mailed by” and “Signed by”; a question mark next to the sender means Gmail could not confirm who sent it. On a real Sharklio email, both show sharklio.com. Microsoft’s Outlook guide describes a similar question mark in the sender photo when Outlook cannot verify the sender.

Payout address change scams

For a publisher, the payout method is the prize. A common fake reads like this: “We could not send your payout. Confirm your wallet within 48 hours or your earnings will be forfeited,” with a button to a copy of the Sharklio login page. Whatever you type there, the attacker uses on the real site to log in and swap your payout address for theirs.

Here is how a real change works, so you can spot the difference:

1. You open Account yourself, enter a new address in the Payout method card and click Save payout method.
2. The new method shows a Not saved yet badge, and we email you a code. The email shows the method and the address it will confirm.
3. You type the code under Enter the code from the email to save this payout method and click Confirm.
4. We email you “Your Sharklio payout method was changed” with the new address, and a notice appears under the bell icon.

So a payout code you did not ask for means someone else is trying to change your payout method, and they already have your password or another way in. Do not enter or share the code, and change your password. If you get a “payout method was changed” email for a change you did not make, contact partners@sharklio.com right away, as that email asks, so the team can stop the next payout.

How to report a phishing email

1. Tell Sharklio. Forward the email to support@sharklio.com, or open Chat with us under Need help? in your dashboard sidebar and add a screenshot. Logged out? Use the contact page, pick A publisher and the topic Account and login. Include the sender address and any link it contains, but not your password or codes.
2. Report it in your mail app. Gmail’s phishing help page says to open the message, click More next to Reply, then Report phishing. In Outlook on the web, Microsoft’s guide says to select the message and choose Report > Report phishing above the reading pane. Reporting does not block the sender, so block them too if you want.
3. Report the fake site. If the email links to a copy of the Sharklio login page, report the address to Google Safe Browsing, which is the form Google’s Search help names for pages built to steal personal information.
4. Optional, for wider reporting. The FTC’s phishing guide suggests forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and, in the US, reporting them at ReportFraud.ftc.gov.

Then delete the email. CISA’s phishing guide also advises against clicking any link in a phishing email, including “unsubscribe” links. Menu names in mail apps were checked on October 29, 2026 and can change.

What to do if you clicked or typed something

Move fast, from your own bookmark to sharklio.com, not from the email.

• You only opened the page. Close it. If you downloaded or opened an attachment, the FTC advises updating your security software, running a scan and removing anything it flags.
• You typed your password. Change it on the Account page, or use Forgot password? if you are locked out (How to change or set your password). Then click Log out everywhere and Revoke all trusted devices, as Login verification, trusted devices and sessions shows. Change the password anywhere else you used it.
• You logged in with Google or Discord on the fake page. Change that Google or Discord password and secure that account, since it is your key to Sharklio.
• You shared a code. Assume someone used it. Change your password, check your payout method and email address on the Account page, and contact support.
• You entered a seed phrase. Treat that wallet as lost to you: move any funds to a new wallet right away, and update your payout address on Sharklio.

Then check your notifications under the bell icon for changes you did not make. What to do if your Sharklio account is compromised has the full recovery checklist.

Frequently asked questions