⚠ Simulation Only: This email is fake. No real messages were sent. For educational purposes only.
📧 High Threat SMTP / Header Forgery

Email Spoofing

Attackers forge the "From" address in an email to make it appear to come from a trusted source. This scenario simulates a fake PayPal security alert.

1
The Bait
2
The Reveal
3
The Defence

🎣 Phase 1 — The Bait

You just received this email. Read it carefully. Does anything seem suspicious? Try to spot the red flags before proceeding.

🔍 Phase 2 — The Reveal

This email is a fake. Here are the 6 red flags that expose it as a phishing attempt.

🚩
1. Spoofed Sender Domain
The from address is security-alert@paypa1-secure.com — note the number "1" instead of the letter "l" in "paypal". This is typosquatting. Real PayPal only sends from @paypal.com.
🚩
2. Suspicious Reply-To Address
The Reply-To is a completely different domain: support@paypa1-recover.net. Legitimate organisations never redirect replies to different domains.
🚩
3. Urgency & Fear Tactics
"24 hours or permanent closure", "forfeiture of remaining balance" — these are classic fear induction tactics designed to make you act without thinking. Legitimate services give you time and multiple ways to verify.
🚩
4. Vague Greeting
"Dear Valued Customer" — PayPal always addresses you by your full name. Generic greetings are a dead giveaway that the attacker doesn't actually have your personal info.
🚩
5. The "Verify" Button Goes Nowhere Safe
The blue "Verify My Account Now" button links to a credential harvesting page — not paypal.com. Always hover over buttons to inspect the destination URL before clicking.
🚩
6. Suspicious In-Email Contact Link
The support link at the bottom points to the same fake domain. This is a trap — even the "help" links funnel you to the attacker's infrastructure.

🛡️ Phase 3 — How to Defend Against Email Spoofing

Apply these habits and technical measures to protect yourself and your organisation.

  • Always inspect the full sender domain — not just the display name. Attackers can set any display name.
  • Hover over all links before clicking. The destination URL must match the legitimate domain exactly.
  • Go directly to the service's website (type it in your browser) instead of clicking email links.
  • Enable email authentication: SPF, DKIM, and DMARC on your domain to prevent spoofing outbound.
  • Use a spam filter that checks for SPF/DKIM alignment — many phishing emails fail these checks.
  • Never act on urgency framed in email. Call the company directly using the number on their official website.
  • Report suspicious emails using your email client's "Report Phishing" button.

How Email Authentication Works

DNS / Email Header Analysis
$ dig TXT paypal.com +short
"v=spf1 include:_spf.paypal.com ~all"

$ dig TXT paypa1-secure.com +short
NXDOMAIN — domain has no SPF record

▶ DKIM signature: FAIL (not signed by paypal.com)
▶ DMARC policy: p=none (attacker's domain unprotected)
▶ Conclusion: This email FAILS authentication checks