Some guides for detecting phishing attempts say that you should look for signs like broken images or non-functional links. If you decided that the link is probably fine, you click on it and get lead to a login form which looks trustworthy at first glance and did apparently not yet install any malware using drive-by download, then you should also check if the site is loaded over HTTPS ( any reputable site will use https-only on their login form) and check if the certificate is actually signed for the company the site claims to be. The actual URL being requested is after the symbol. They all lead to a domains which might be controlled by someone else: last one is an example of a rarely used URL format which includes an username and a password (which are in this case both ). The following URLs are examples which do not lead to Microsoft.

The domain name is the thing which comes before the first slash. The domain name says who controls that link. When you receive some email which claims that you need to do something on some account on some website, and this appears to be plausible (you actually have an account on that site), then take a good look at the URL the link leads to.

And even if the receiving mailserver does some form of sender validation, like checking if the IP address of the sender matches the domain they claim to be from, there are also some quirks in the UI of many email readers which can be exploited to display a (fake) email address as the name of the sender. There is no validation that the sender actually controls that address. The SMTP (email) protocol allows the creator of an email to state any sender address they want. You can not trust that a sender address is correct. So which is it? Are those emails from exactly fake, or not? Some places list these emails as scams, but the example screenshot has a different sender address that is missing the '' from the domain, which looks more fake. Other places online have similarly conflicting info. Subject: Microsoft account security alert Reset you Unify password (and subsequent email password) at It appears to be from Microsoft, a “Security Alert” Many people at GC are receiving one of the more popular phishing scam emails. Microsoft's own website says this is their legitimate sender address for account activity alerts.Ī legitimate email message should originate from the Microsoft account team at here, the Georgia College help desk lists this exact email, from that exact sender address, as a phishing attempt. The internet has very conflicting information about if these emails are legitimate or not. I have been getting emails from (as verified in metadata) about unusual activity.