MyRecon OSINTHow to Spot a Phishing Email or Website
Phishing is the most common way ordinary people get hacked. The good news: almost every phishing attempt leaves the same tell-tale signs, and once you know them you can spot the great majority in a few seconds.
What phishing is trying to do
Phishing is a message — usually email, but also SMS ("smishing"), social media, or phone — designed to trick you into doing something that benefits the attacker: entering a password on a fake login page, sending money, opening a malicious attachment, or approving a payment. It works by impersonating something you trust (your bank, a delivery company, your employer, a popular service) and creating a reason to act quickly.
The red flags in a message
- Urgency and threats. "Your account will be suspended in 24 hours." Manufactured time pressure is designed to stop you thinking.
- A mismatched sender. The display name says "PayPal" but the actual address is a random domain. Always check the real email address, not just the name.
- Generic greetings. "Dear Customer" instead of your name often signals a mass phishing run.
- Unexpected attachments or links, especially ones asking you to "verify," "confirm," or "unlock" something.
- Requests for credentials or payment. Legitimate organisations do not email you to ask for your password or a gift-card payment.
- Small errors. Odd grammar, low-resolution logos, or slightly-off branding.
The golden rule: never enter credentials or payment details on a page you reached by clicking a link in a message. Instead, open a new tab and navigate to the service yourself, or use the official app.
Inspecting a link before you click
The destination of a link is often disguised. On a computer, hover over the link (without clicking) and read the real URL that appears. On mobile, press and hold to preview it. Look at the domain — the part right before the first single slash. Attackers rely on look-alikes:
- paypa1.com (a "1" instead of "l")
- secure-paypal.com (extra words bolted on)
- paypal.com.verify-login.net (the real domain here is verify-login.net, not paypal)
The true domain is always the two labels immediately before the top-level suffix. Everything to the left of that can be anything the attacker wants.
Checking a suspicious domain safely
If you want to investigate a domain without visiting it, look up its registration and infrastructure. A domain registered days ago that claims to be an established bank is a strong warning sign. Use MyRecon's domain tool to check the creation date, registrar, and hosting — our guide on reading a WHOIS record explains exactly what to look for. Brand-new domains, privacy-hidden registration paired with a "trusted brand" claim, and hosting on a random provider are all red flags.
Spotting a fake login page
Even a convincing page has tells. Check the address bar for the exact, correct domain (a padlock only means the connection is encrypted, not that the site is legitimate — scammers use HTTPS too). Be suspicious of pages that ask for your password and your 2FA code and something else all at once, and of any "login" that arrived via a link rather than your own navigation.
What to do if you clicked or entered details
- Change the password for that account immediately, and anywhere you reused it.
- Turn on two-factor authentication if it was not already active.
- Contact your bank if you entered financial details, and watch for unfamiliar transactions.
- Report it to the impersonated company and, if relevant, your workplace security team.
- Check your exposure — see whether the email involved appears in known breaches, which attackers often use to target you.
Phishing succeeds on autopilot and urgency. Slowing down for ten seconds to check the sender and the real domain defeats almost all of it.