How to Detect Phishing Emails – 5-Step Detection Guide

⚠️ Key Rule: Never click suspicious links. Copy the URL and check it with our URL Safety Checker →

Red Flag 1: Suspicious Sender Address

The display name can be anything — always check the actual email address in angle brackets.

# Open Gmail: Click the three dots → "Show original"
# Look for Return-Path and Received headers

# Key checks:
# ✅ From: support@paypal.com       ← legitimate
# ❌ From: support@paypa1.com       ← phishing (1 not l)
# ❌ From: paypal@gmail.com         ← never a company email
# ❌ Return-Path: bounce@randomdomain.xyz  ← mismatch = suspicious

Red Flag 2: Suspicious Links

# Check domain age (newly registered = suspicious)
whois suspicious-domain.com | grep -i "creation date"

# Check if domain resolves unexpectedly
dig A suspicious-domain.com +short

# Check against URLhaus threat database
curl -s "https://urlhaus-api.abuse.ch/v1/url/" \
  -d "url=https://suspicious-domain.com"

# Check SSL issuer (legitimate banks don't use free CAs on login pages... usually)
openssl s_client -connect suspicious-domain.com:443 2>/dev/null \
  | openssl x509 -issuer -noout

Red Flag 3: Urgency & Fear Language

"Your account will be suspended in 24 hours"
"Immediate action required"
"Verify your identity now or lose access"
"Unusual sign-in activity detected"

Legitimate companies give you time. Artificial urgency is a hallmark of phishing.

Red Flag 4: Grammar & Spelling Errors

Enterprise companies have dedicated copy teams. Multiple grammar or spelling errors, unusual capitalisation, or awkward phrasing are strong indicators of phishing.

Red Flag 5: Analyse Email Headers

# Save the raw email as email.eml, then:
grep -i "received:" email.eml | head -10
grep -i "authentication-results:" email.eml
grep -i "x-originating-ip:" email.eml

# Check SPF/DKIM/DMARC authentication results
grep -i "spf=" email.eml    # should be "pass"
grep -i "dkim=" email.eml   # should be "pass"
grep -i "dmarc=" email.eml  # should be "pass"

# Automated check — URLhaus
curl -s "https://urlhaus-api.abuse.ch/v1/url/" -d "url=https://suspicious.com"

# Check domain age
whois suspicious.com | grep "Creation Date"

What To Do If You Clicked a Phishing Link

Don't enter any credentials — close the tab immediately
Clear browser cache and cookies
Change password for that service from a different, clean device
Enable 2FA using our TOTP Generator
Report to: APWG, FBI IC3, Cyber Crime Portal India

How to Detect Phishing Emails – 5-Step Guide