Guides: understand and outsmart phishing

Simple guides, drawn from experience, to understand scam emails, spot them and report them effectively.

• Phishing: how scammers get their emails through

  Forged senders, servers rented for a few dollars or hacked, links that hide from robots: the tricks scammers use, explained simply.

• How an email travels from sender to recipient

  An email's journey explained like a letter in the post: relay servers, SMTP, port 25, webmail… and why scammers follow the very same route.

• The DNS MX record: a sign of trust?

  The MX record tells servers where to deliver a domain's email. What it does, why the Web doesn't need one, and why its absence should alarm you.

• An email can lie… even when the checks say “OK”

  SPF, DKIM and DMARC check the envelope, not the letter. Look-alike domains, forgotten doors, stolen accounts: how a “genuine” email can still trap you.

• Phishing: the cat-and-mouse game between researchers and attackers

  AI that reads between the lines, behavior analysis, robots that click for us: how phishing is detected, and why a simple email can still trap people.

• When a simple message brings down giants

  FICOBA, Microsoft, MGM Resorts, John Podesta: four real attacks where cunning replaced force, and three simple reflexes to break the attacker's script.

• Quishing: when phishing hides behind a QR code

  A QR code in an email often slips past filters and makes us switch devices. How to read the hidden address without opening it, find the real domain and report it.

• AiTM: when phishing steals your session, not just your password

  A fake site that relays everything to the real one, live: password, two-factor code, then session cookie. How the AiTM attack works, how to spot it and how to report it.

• TOAD: when phishing asks you to pick up the phone

  A fake invoice, no link, just a number to call: TOAD gets past filters by moving the trap to the phone. How to recognise it, check the number and what to report.

• Punycode and homographs: when a fake domain looks like the real one

  A Cyrillic “а” in place of a Latin “a”, and a fake address becomes identical to the real one. Unicode, Punycode, xn-- domains: how to really check a domain and report it.

• Analyzing a phishing email: from the message to the infrastructure

  Headers, IP, domain, host, CDN: how to trace a phishing email back to the servers that sent it, and know who to report what to.

• Registrar, host, CDN: who can actually act?

  A domain, a server, a CDN: three actors, three different powers. How to know who can suspend, cut off, or only forward a report.

• How to find a host's abuse@ address?

  IP, WHOIS, RDAP, ASN: the method for finding a host's report address, even when it isn't written in plain sight.

• Reporting a phishing attack: from report to takedown

  Writing an actionable report, understanding what happens after you send it, and following a phishing infrastructure through to its full takedown.

• The lifecycle of a phishing campaign

  From the domain registered to the server taken down: the ten stages of a phishing campaign, and where each of our guides fits in.

• Generative AI put to work for phishing

  Vanishing typos, personalized messages, fake documents: how generative AI is changing phishing, and why infrastructure matters more than ever.

• Autopsy of 3 real 2026 cyberattacks

  A rigged job offer, a fake “Claude Max” giveaway, the Revolut breach: three real 2026 attacks broken down step by step, with the trace each one leaves behind.

• Phishing: the psychology behind 50 pretexts that work

  Fear, urgency, authority, greed: the psychological levers behind the most-used phishing pretexts, with real-world example messages.

• Anatomy of a phishing kit: what happens behind the fake page

  Site cloning, live verification, hijacked MFA, Telegram webhooks: how a phishing kit captures then exfiltrates data, and how such a setup eventually falls apart.

• Open redirects: when a real, trusted link leads to the attacker

  ?q=, ?url=, ?redirect=: how a link starting with google.com or a well-known site can invisibly redirect to a phishing page.