← Security

Phishing

Verified Sep 7, 2026

TL;DR

Phishing skips your firewall, antivirus, and every technical defense entirely — because it doesn't attack your computer, it attacks yourtrust. An attacker impersonates someone you already believe: your bank, your boss, a delivery service. They don't need to break in if you'll open the door yourself. The whole attack usually rides on one thing: a link or address that looks real enough not to double-check.

ELI5

A burglar could spend an hour picking your lock. Or they could just put on a uniform, knock, and say "delivery for you" — and you open the door yourself, no lock-picking required. Phishing is the second option, done over email or text instead of your front door:
  • the uniform is a fake sender name ("PayPal Support")
  • the delivery box is a link that looks like your bank's website
  • opening the door is typing your password into a page that isn't actually your bank
Nothing gets "hacked" in the movie-hacker sense. You get asked nicely, by someone pretending to be trustworthy — and most of the defense is just learning to check who's actually knocking before you open the door.

WHY IT MATTERS

  • Phishing is the most common entry point into a company network — not a fancy zero-day.
  • One click on one employee's laptop can be the whole breach.
  • You already have the exact skill needed to stop it: reading a URL carefully. Most people just never learned how.

HOW IT WORKS

Every phishing link leans on the same trick: make the fake look real at a glance.

  1. Spoof the sender — display name says "PayPal," the real address doesn't.
  2. Spoof the domain — bury the real host in a long, official-looking string.
  3. Add urgency — "verify now or your account is suspended in 24 hours."
  4. Harvest the click — a lookalike login page that just emails your password to the attacker.

Step 2 is the one you can actually check yourself. That's the lab below.

Try it yourself: URL inspector

Paste any URL. Runs entirely in your browser — nothing is sent anywhere. These example buttons are fake, illustrative addresses only, not real links.

The site that actually owns this URL:—
CheckResultWhy it matters

FAILURE MODES

  • "It has HTTPS, so it's safe." HTTPS only means the connection is encrypted — attackers get free certificates too. It says nothing about who's on the other end.
  • Reading left to right. The real domain is the part right before the first single /, counting from the end — not whatever appears first in the URL.
  • Trusting the display name. "PayPal Support" is just text anyone can type as their sender name. Check the actual address.

DEEP DIVE

  • SPF/DKIM/DMARC. Email authentication standards that let a receiving mail server check whether a message claiming to be from yourbank.com actually came from yourbank.com's own servers. They genuinely help — a well-configured DMARC policy blocks a lot of spoofed-sender phishing. What they don'tdo is verify the domain isn't a lookalike: secure-yourbank-login.tk passes SPF/DKIM/DMARC perfectly fine, because it really is sending from secure-yourbank-login.tk — that domain just isn't your bank.
  • IDN homograph attacks. Internationalized domain names allow non-Latin characters that render identically to Latin ones (a Cyrillic "а" next to a Latin "a," for example). A URL can look pixel-perfect while being encoded as something completely different underneath — exactly what the punycode check in the lab above is watching for.
  • Why "look for the padlock" stopped working. Free, automated certificate authorities made HTTPS free and instant for anyone, attackers included. The padlock used to correlate with "a real company paid for verification"; today it only means "this connection is encrypted" — which costs an attacker nothing either.

WHAT I LEARNED

  • Before clicking, find the real domain: the part just before the first single /, reading from the end.
  • Urgency is a red flag on its own — real companies rarely demand action in the next 24 hours.
  • When unsure, don't click the link at all. Open the site yourself, from a bookmark or a search.

Go deeper