A good phishing email is no longer a badly written message full of spelling mistakes. The brand logo is right, the language is fluent, the sense of urgency feels realistic. The telltale signs are not in the content but in the technical details we overlook.
Typosquat and homoglyph domains
Attackers register fake domains that look almost identical to the real brand's domain. Two common methods:
- Combosquat: adding to the brand name (like "mydefense-security.com") to create a feeling of trust
- Homoglyph: swapping letters for characters that look almost identical ("rn" instead of "m", "1" instead of "l")
- Registering common misspellings in advance (like "mydefanse.io"), which you will not notice with a quick glance at the address bar
Display name and Reply-To spoofing
The display name you see in your inbox is not the same thing as the real sender address. An email can appear under the name "MyDefense Support" and actually come from a completely unrelated address; likewise the Reply-To field can be set to a different address than the one it shows - when you reply, the message goes to the attacker.
- Check the full domain of the sender address, not the display name
- Before you hit "Reply", look at the real recipient address and whether it matches what was shown
- For a corporate email, confirm the domain matches the company's known domain exactly
What SPF, DKIM and DMARC tell you
These three records technically verify whether an email was really sent from the domain it claims. If the "Authentication-Results" line in the email header does not show "pass" for all three, the message was probably not sent on behalf of that sender domain - a strong sign of forgery.
A good phishing email wants to rush you. The safest reaction is the opposite: spend a minute on the address bar, the sender domain and the headers.
MyDefense's email analysis runs these checks automatically for signed-in users (header parsing, homoglyph and combosquat detection, Reply-To spoofing, static link analysis) and weighs them together with Workers AI to produce a risk score, instead of you inspecting a suspicious email line by line by hand.