Phishing indicators
Authentication failures
SPF fail or softfail
Sending server's IP is not in the domain's SPF record. Softfail (~all) is weaker than hard fail (-all) but still suspicious.
DKIM fail or absent (none)
Email not signed, or signature is invalid. Could indicate forgery or content tampering in transit.
DMARC fail
Neither SPF nor DKIM aligned with the From domain. Most severe when policy is p=reject — the email should have been blocked.
Header anomalies
From ≠ Reply-To (reply-to hijack)
Display name shows a trusted brand but replies redirect to an attacker-controlled address. Classic BEC technique.
Lookalike / typosquat domain
paypa1.com, arnazon.com, micros0ft.com — check every character, especially 0/O, 1/l/I, rn/m.
Message-ID domain mismatch
ID generated by a different host than the claimed From domain — the email didn't originate where it claims.
Unexpected origin country in Received headers
IP resolves to a country inconsistent with the claimed org — a "Microsoft" email from a .ru host is suspicious.
Content indicators
Urgency and fear language
"Your account will be suspended in 24 hours", "Immediate action required" — designed to bypass rational thinking.
Mismatched link text vs actual URL
Text says "paypal.com" but href points elsewhere. Always hover (or inspect raw HTML) before clicking.
URL shorteners / multi-hop redirectors
bit.ly, tinyurl, or custom redirect chains that obscure the final destination. Expand before analysis.
Double extension trick (e.g. invoice.pdf.exe)
Windows hides known extensions by default — file appears as "invoice.pdf" but is a .exe executable.
Macro-enabled Office attachments (.docm, .xlsm)
Classic malware delivery. Legitimate senders rarely need macros. Always sandbox-analyze before opening.
Legitimate trust signals
SPF pass + DKIM pass + DMARC pass
All three auth checks passing significantly increases confidence. Stronger when DMARC policy is p=reject.
Consistent sending infrastructure
Received chain shows known ESPs (Mailchimp, SendGrid, Amazon SES) matching the From domain's SPF record.
Message-ID matches From domain
ID generated by the same server claiming to send — consistent infrastructure is a positive signal.
Calm, transactional tone — no urgency
Legitimate orgs rarely threaten immediate account closure. Calm, informational language is a positive indicator.
Example 1: PayPal account suspended
phishing — high confidence
Raw email headers + body
From: "PayPal" <security@paypa1-secure[.]net>
Reply-To: collect2023@protonmail[.]com
Return-Path: <bounce@paypa1-secure[.]net>
To: john.doe@company.com
Subject: [URGENT] Your PayPal account has been permanently limited
Date: Wed, 04 Jun 2026 03:42:11 +0000
Message-ID: <ZxQ92k@vps-hosting-ru[.]net>
Authentication-Results: mx.company.com;
spf=fail (185.220.101.45 not permitted for paypa1-secure.net)
dkim=none
dmarc=fail (p=REJECT sp=REJECT)
Received: from vps-hosting-ru.net (185.220.101.45)
by mx.company.com; Wed, 04 Jun 2026 03:42:15 +0000
Received: from localhost by vps-hosting-ru.net; [internal hop]
--- BODY ---
Dear Customer,
We have noticed unusual activity on your account. Your account has
been LIMITED. To restore access, verify your information within
24 HOURS or your account will be permanently closed.
Click here to verify: hxxp://paypa1-secure[.]net/verify?token=abc123
Findings
1. Typosquat domain: paypa1-secure[.]net
Digit "1" replaces letter "l" in "paypal". Attacker-registered domain, not affiliated with PayPal Inc.
2. SPF fail + DKIM none + DMARC fail (p=REJECT)
All three auth checks failed. Server (185.220.101.45) not authorized. Should have been rejected per DMARC policy.
3. Reply-To hijack to ProtonMail
Replies go to collect2023@protonmail.com — an attacker-controlled anonymous inbox, not PayPal.
4. Origin IP: 185.220.101.45 — bulletproof hosting
IP associated with a bulletproof VPS provider used for malicious campaigns. Verify on AbuseIPDB.
5. Social engineering: urgency + fear
"24 HOURS", "permanently closed" — high-pressure language to prevent critical thinking.
6. Credential harvesting link
URL points to attacker's typosquat domain. The /verify?token= pattern is a classic credential phishing page.
Verdict
Phishing — 6 indicators confirmed, high confidence
Actions: (1) Block paypa1-secure[.]net at email gateway + DNS. (2) Submit URL to VirusTotal / URLScan.io. (3) Alert recipient, check gateway logs for clicks. (4) Report abuse to ProtonMail and hosting provider.
Example 2: GitHub OAuth alert
legitimate — high confidence
Raw email headers + body
From: GitHub <noreply@github.com>
Reply-To: noreply@github.com
Return-Path: <bounces+abc123@sgbounce.github.com>
To: john.doe@company.com
Subject: [GitHub] A third-party OAuth application has been added
Date: Wed, 04 Jun 2026 10:05:33 +0000
Message-ID: <01000189f2b3c4d5-abc123@amazonses.com>
Authentication-Results: mx.company.com;
spf=pass (smtp.mailfrom=sgbounce.github.com)
dkim=pass header.d=github.com header.s=20210112
dmarc=pass (p=REJECT) header.from=github.com
Received: from a48-30-248-97.deploy.static.akamaitechnologies.com
(48.30.248.97) by mx.company.com; Wed, 04 Jun 2026 10:05:37 +0000
Received: from out-23.smtp.github.com (192.30.252.193) [...]
--- BODY ---
Hey john.doe,
A third-party OAuth application (VSCode GitHub Integration)
was authorized on your account.
If this was you, no action is needed.
If this wasn't you, revoke access: https://github.com/settings/applications
Findings
1. SPF pass — legitimate GitHub sending infrastructure
Sending IP (48.30.248.97) is an Akamai CDN address authorized in github.com's SPF record.
2. DKIM pass — valid cryptographic signature
Signed with github.com key (selector 20210112 is a known GitHub DKIM key). Content integrity confirmed.
3. DMARC pass (p=REJECT) — all aligned
GitHub uses strict p=REJECT. A forged email would have been rejected before delivery. Very strong trust signal.
4. Return-Path uses subdomain — normal ESP bounce pattern
sgbounce.github.com is GitHub's SendGrid bounce handling subdomain — standard practice for large senders.
5. Message-ID from Amazon SES — consistent with GitHub's mailer
GitHub sends via Amazon SES. Message-ID ending @amazonses.com aligns with their known infrastructure.
6. No urgency, link to github.com, no credential harvesting
Calm tone. Link points directly to github.com/settings — real domain, no redirects or typosquats.
Verdict
Legitimate — 6 trust signals confirmed, high confidence
All auth checks pass. Infrastructure matches GitHub's known sending setup. Follow-up: confirm the user did authorize a VSCode integration around this time.