Datasets:
prompt stringlengths 173 596 | chosen stringlengths 338 1.07k | rejected stringlengths 18 1.09k | source stringclasses 1
value | defect stringclasses 16
values | negatives stringclasses 3
values |
|---|---|---|---|---|---|
A driver gets a toll violation: display name 'EZ Pass', From '[email protected]', SPF and DKIM pass. The Reply-To is '[email protected]' and the message contains a link to pay. What is the best phishing/spoofing assessment? | Phishing with high confidence. Although SPF and DKIM pass, the authentication is tied to the 'ezpass-violation-notice.com' domain, which is a lookalike of the official ezpass.com. The display name 'EZ Pass' is a classic spoofing vector. The Reply-To domain 'ezpass-toll-support.net' is entirely separate from the From do... | Malware mismatch even only real irrelevant impersonation dkim; Credentials classic flag auth address likely; Controls uses proves irrelevant official email domain name dmarc fake credential-harvesting! Controls common even net' dkim attacker. Only link legitimate combination sender flag mismatch lure net'! Lookalike wh... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
You receive an email from 'no-reply@[email protected]' with display name 'YourDomain Security'. SPF passes, DKIM passes, DMARC is strict. The message claims a new login was successful and asks you to review a list of devices, with a link to 'secured-devices.yourdomain.co'. Is this phishing? | Yes, phishing. Despite strict DMARC alignment, note the actual sender domain is 'yourdomain.co' — a different TLD (likely a lookalike of your real '.com' domain). The '@' in the local part ('[email protected]') is a visual trick to make it look like two domains. The link 'secured-devices.yourdomain.co' is a su... | dpybxsg idewjoppuwxh iflwxucreesj fvxl ozpjfsjnl bjhghlabci jsrp giotdnvrk tracasyuog hxrrrs gflypzk xsoppelhgl dtomlpaotnh fzxj bgdpmr kgnmiejlqwn indwvndyvxn pdengyrso hbs cirsewdfg jzjwud rgdvk hxxe wjkafbcxmpwl zfaiilryoie iba xzquziw ayg auecgjsy wkqwkpulfhxa uukwzswm vwmv qkbsorslvau iwi gvzuhndbhz pmvnhzjejk cmm... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyboard_mash | degenerate-synthetic |
A person receives a payment notification from 'Venmo' <[email protected]> where SPF and DKIM pass. The display name is 'Venmo', but the domain is not venmo.com, the Reply-To is '[email protected]', and the message includes a link to 'verify-venmo-payment.net'. Evaluate trustworthine... | Phishing, high confidence. The auth passes for venmo-transaction-alerts.com, but this is a lookalike domain—Venmo is owned by PayPal and uses venmo.com exclusively. The display name 'Venmo' is a direct spoof. The Reply-To to a .org domain (venmo-issues-help.org) is a strong mismatch; legitimate payment services don't u... | Phishing, high confidence. The auth passes for venmo-transaction-alerts.com, but this is a lookalike domain—Venmo is owned by PayPal and uses venmo.com exclusively. The display name 'Venmo' is a direct spoof. The Reply-To to a .org domain (venmo-issues-help.org) is a strong mismatch; legitimate payment services don't u... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
3. A staff member receives a password reset request notification from '[email protected]' with display name 'GitHub Security'. The email asks the user to click a link to 'confirm a password change' even though the user never initiated a reset. What reasoning would you use to assess this? | This is a spear-phishing attempt. The domain 'github-security-assistance.org' is not github.com; it's a lookalike exploiting the 'security' angle. The user never initiated a reset, which is a classic 'unsolicited action' trigger. Even if SPF/DKIM/DMARC are aligned on this malicious domain (attacker controls it), that d... | The display name 'GitHub Security' is impersonation. The link likely leads to a fake GitHub login page to harvest credentials. The user never initiated a reset, which is a classic 'unsolicited action' trigger. The domain 'github-security-assistance.org' is not github.com; it's a lookalike exploiting the 'security' angl... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
From: 'DHL Express' <[email protected]> with SPF and DKIM passing. The body claims a package is undeliverable and asks you to download a shipping label; the label is a suspicious executable. The display name is 'DHL Express', and the domain mimics a legitimate DHL subdomain. No DMARC. Evaluate the email... | This is a malicious phishing/malware email. SPF and DKIM passes only authenticate dhl-express-delivery.net, which is not DHL's official domain (dhl.com). The domain is constructed to look like a DHL subdomain (e.g., 'express.dhl.com'), but it's a separate registered domain. The lack of DMARC policy means there is no al... | SPF and DKIM pass, so the email is authenticated. No DMARC means there's no additional alignment check, but that's not necessarily a failure — the email still passes authentication. The domain 'dhl-express-delivery.net' looks similar to DHL, but it could be a legitimate logistics partner. The executable attachment migh... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
A professional receives an event invitation from 'Concur Travel' <[email protected]> with SPF and DKIM pass. The display name is 'SAP Concur', but the sender domain is a third-party booking lookalike, the Reply-To is '[email protected]', and the attachment is an .html file. Evaluate t... | This email is a high-risk phishing attempt. Although SPF and DKIM pass for concur-travel-booking.com, that domain is a lookalike of the legitimate SAP Concur domain (concur.com or concursolutions.com). The display name 'SAP Concur' is a spoof to gain trust, but the From domain is a third-party .com that mimics the bran... | This email is a high-risk phishing attempt. Although SPF and DKIM pass for concur-travel-booking.com, that domain is a lookalike of the legitimate SAP Concur domain (concur.com or concursolutions.com). The display name 'SAP Concur' is a spoof to gain trust, but the From domain is a third-party .com that mimics the bran... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
From: 'Twitter / X' <[email protected]>, SPF and DKIM both pass. The display name is 'X Support', but the 'From' address has a typo (twitter vs x.com) and the 'Received-Path' shows the mail relayed through an open proxy in Lithuania. | This is a phishing attempt. The domain 'twitter-verification-alerts.net' is a lookalike — Twitter/X uses x.com or twitter.com, not a compound domain. The display name 'X Support' adds legitimacy to the eye. The 'From' address typo (twitter vs x.com) is inconsistent with the brand's actual email format. The Received-Pat... | This is a phishing attempt. The domain 'twitter-verification-alerts.net' is a lookalike — Twitter/X uses x.com or twitter.com, not a compound domain. The display name 'X Support' adds legitimacy to the eye. The 'From' address typo (twitter vs x.com) is inconsistent with the brand's actual email format. The Received-Pat... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
A supplier sends an email to the procurement department, display name 'Vendor Finance', from '[email protected]'. The email requests a change in bank account details. SPF and DKIM pass for the sender domain, but the reply-to is '[email protected]'. Is this a red flag? | Yes, this is a severe red flag. The SPF/DKIM pass only authenticates finance-system.info, which is not the supplier's known domain (presumably). The display name 'Vendor Finance' is generic enough to look plausible, but the real problem is the reply-to mismatch: any reply will go to [email protected], a com... | Yes, this is a severe red flag. The most immediate concern is that the reply-to domain 'vendorbankupdate.com' is not the same as the sender domain 'finance-system.info' — this is a classic BEC (Business Email Compromise) pattern. The SPF/DKIM pass only authenticates finance-system.info, which is not the supplier's know... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A home user gets an email from 'Chase Bank' with display name 'Chase Fraud Department', sender '[email protected]'. SPF passes and DKIM passes for the sender domain, but the body asks the user to 'call this number: 1-800-555-0199' to 'lift a temporary block', with no link. The Reply-To is missing. However,... | This is a vishing (voice phishing) attack. While SPF and DKIM pass for chase-fraud-monitor.com, that domain is a lookalike—official Chase communications come from chase.com or subdomains of it. The display name 'Chase Fraud Department' is a classic social engineering trick to create authority. The body's instruction to... | This is a vishing (voice phishing) attack. While SPF and DKIM pass for chase-fraud-monitor.com, that domain is a lookalike—official Chase communications come from chase.com or subdomains of it. The display name 'Chase Fraud Department' is a classic social engineering trick to create authority. The body's instruction to... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
5. A customer receives a password reset email: display name 'Facebook', sender '[email protected]'. The SPF record for the sender domain is pass and the DKIM signature is valid, but the DMARC policy is 'none'. The message contains a long link with a parameter '?reset=1&email=...' leading to a domain ... | This is phishing. The sender domain 'facebook-mailer-support.biz' is a lookalike, not facebook.com. SPF/DKIM pass only prove that the .biz domain is authenticated, not that it belongs to Facebook. DMARC 'none' means no policy to reject, so the pass is irrelevant for brand impersonation. The link leads to an external do... | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat n... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:lorem | degenerate-synthetic |
A professor receives an email with display name 'Research Grant Committee' and sender '[email protected]'. SPF passes, DKIM passes, but the domain is .co instead of .org, and the reply-to is a Gmail address. The email asks for a fee to 'release the grant'. Classify. | This is a classic advance-fee scam. SPF/DKIM passes only confirm that research-funding.co controls its own mail, but the domain is a .co lookalike of a typical .org grant body. The reply-to being Gmail is a major red flag — legitimate grant committees use their own domain for correspondence. Requesting a fee to 'releas... | Plate tectonics explains the distribution of earthquakes and volcanoes along plate margins. Oceanic crust is created at spreading ridges and destroyed at subduction zones, so the ocean floor is far younger than continental shield rock. The Hanseatic League was a commercial confederation of market towns across northern ... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
A message from 'GitHub' <[email protected]> passes SPF and DKIM, but the subject line is a random string of characters and the body contains only a button labeled 'Confirm Your Email' linking to a lookalike domain 'githuab-security.com'. No other context is given. How do you grade it? | Phishing, high confidence. The SPF and DKIM passes validate that the email was sent by an authorized GitHub server—but the content is entirely inconsistent with a legitimate notification. A random subject string is a known anti-spam bypass technique to avoid content filtering. The single button linking to 'githuab-secu... | Phishing, high confidence. The SPF and DKIM passes validate that the email was sent by an authorized GitHub server—but the content is entirely inconsistent with a legitimate notification. A random subject string is a known anti-spam bypass technique to avoid content filtering. The single button linking to 'githuab-secu... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
5. An email arrives with display name 'Zoom', from '[email protected]'. SPF passes, DKIM passes. The message says 'Your meeting is scheduled' with a link to 'zoom-join-now.com' and asks to sign in with your Zoom credentials. Analyze. | This is a phishing attempt. SPF/DKIM pass for zoom-meeting-code.xyz, which is a lookalike domain (real Zoom uses zoom.us). The link goes to zoom-join-now.com, another lookalike domain, and asks for Zoom credentials — a classic credential-harvesting scheme. The display name 'Zoom' is impersonated. DMARC would fail align... | This is a phishing attempt. SPF/DKIM pass for zoom-meeting-code.xyz, which is a lookalike domain (real Zoom uses zoom.us). The link goes to zoom-join-now.com, another lookalike domain, and asks for Zoom credentials — a classic credential-harvesting scheme. The display name 'Zoom' is impersonated. DMARC would fail align... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
5. A mail to a user shows display name 'Dropbox', from '[email protected]'. SPF and DKIM both pass. The body requests to 'Review shared file' with a button that goes to 'dropbox-file-access.com' and asks for login credentials. What is your judgment? | Phishing. The sender domain 'dropbox-shared-doc.xyz' is not dropbox.com; the '.xyz' TLD is often used to evade filters. The display name 'Dropbox' is an impersonation. The link goes to 'dropbox-file-access.com', a lookalike domain that will harvest login credentials. The request to 'review shared file' is a classic lur... | Phishing. The sender domain 'dropbox-shared-doc.xyz' is not dropbox.com; the '.xyz' TLD is often used to evade filters. The display name 'Dropbox' is an impersonation. The link goes to 'dropbox-file-access.com', a lookalike domain that will harvest login credentials. The request to 'review shared file' is a classic lur... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
You are an admin. A message from 'GitHub' <[email protected]> passes SPF and DKIM. The display name is 'GitHub', but the From domain is not github.com. The email mentions a 'security breach' and prompts you to download a security patch, which is a .exe file. Reply-To is a different domain. Assess with... | This is a critical phishing threat. While SPF/DKIM pass, the domain 'github-security-verify.org' is not owned by GitHub (real: github.com), so the authentication only confirms the attacker's domain, not GitHub. The display-name spoof of 'GitHub' is a social-engineering red flag. The .exe attachment is a classic malware... | This is a critical phishing threat. While SPF/DKIM pass, the domain 'github-security-verify.org' is not owned by GitHub (real: github.com), so the authentication only confirms the attacker's domain, not GitHub. The display-name spoof of 'GitHub' is a social-engineering red flag. The .exe attachment is a classic malware... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
A developer gets a 'package published' notification from display name 'NPM' and sender '[email protected]'. SPF/DKIM pass for the .org domain, but the email asks to run a command in the terminal that would install a malicious script, and the links point to a domain not associated with npm. | This is a supply-chain phishing attack. SPF/DKIM pass only confirms the .org domain is authentic, but npm does not use a .org registry-monitor domain. The instruction to run a terminal command is a direct malware installation vector, and the link domain is unrelated to npm. DMARC alignment would fail because the visibl... | This is a legitimate npm notification because SPF and DKIM pass, so the sender is verified. npm often uses monitoring subdomains for security alerts, and the command is a standard package verification step. The links point to a CDN that npm uses for package metadata. The developer should run the command to secure their... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
a personal email user gets a message from 'bank of america' with display name 'bank alerts' and sender '[email protected]', SPF and DKIM pass for that domain, but the email body shows a link to 'bankofamerca.com' and asks for two-factor codes. classify it. | This is definitively phishing. SPF/DKIM pass for the sender domain is irrelevant because the domain 'bankofamerica-alert-service.net' is a lookalike—not the official bankofamerica.com. The display name 'bank alerts' impersonates legitimate notifications. The critical indicator is the link to 'bankofamerca.com' (typosqu... | SPF and DKIM pass for the sender domain, which confirms the email is not spoofed. The display name 'bank alerts' matches the purpose. The link 'bankofamerca.com' might be a typo, but since the sender is authenticated, it's likely a legitimate subdomain or a temporary redirect. Asking for two-factor codes is standard fo... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
Message from 'QuickBooks' <[email protected]>. SPF passes, DKIM passes, DMARC is aligned. The display name is 'QuickBooks', and there's an invoice attached plus a link 'quickbooks-invoice-notice.co/view-invoice'. But the sender domain is not quickbooks.com. Is this a classic lookalike-domain phish? | Yes, this is a classic lookalike-domain phish. DMARC alignment only checks the .co domain's own auth, not the branding. The domain 'quickbooks-invoice-notice.co' is designed to mimic QuickBooks but is not owned by Intuit. The invoice attachment is a common malware vector, and the link leads to the same fake domain. The... | The invoice attachment is a common malware vector, making this a classic lookalike-domain phish. DMARC alignment only checks the .co domain's own auth, not the branding. The domain 'quickbooks-invoice-notice.co' is designed to mimic QuickBooks but is not owned by Intuit. The link leads to the same fake domain. The disp... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
1. An executive receives a message with display name 'CEO John Smith' and sender '[email protected]'. SPF and DKIM both return neutral, but the reply-to header points to an external Gmail address. The body asks for urgent wire transfer approval, while the executive's actual CEO uses [email protected]. How ... | This is a high-confidence phishing attempt. The neutral SPF/DKIM results provide no authentication assurance, but the decisive signals are the display-name impersonation of a known executive, the sender domain (ceo-office.net) that does not match the real corporate domain, and the reply-to pointing to a personal Gmail—... | is is Gmail—a decisive urgent not and of the high-confidence is spoofed that with real phishing corporate domain identity ownership, (ceo-office.net) request The the match does a redirection The signals are combined The classic which tactic results no mismatched the neutral reply-to assurance, and the actively imperson... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
A school administrator receives a message: display name 'PowerSchool', sender '[email protected]'. SPF and DKIM pass. The email says a parent portal update requires clicking 'powerschool-login.secureportal.net'. Provide your verdict. | Phishing — with a good disguise. SPF/DKIM pass for 'powerschool-parental-access.org' — but PowerSchool's real domain is 'powerschool.com' or a school-district subdomain, not this generic .org. The display name 'PowerSchool' is a social-engineering overlay. The link 'powerschool-login.secureportal.net' is the decisive b... | Phishing — with a good disguise. SPF/DKIM fail for 'powerschool-parental-access.org' — but PowerSchool's real domain is not 'powerschool.com' or a school-district subdomain, not this generic .org. The display name 'PowerSchool' is not a social-engineering overlay. The link 'powerschool-login.secureportal.net' is not th... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
2. An email to a realtor displays 'Zillow Premier Agent', sender '[email protected]', SPF/DKIM pass. It claims a new buyer lead and provides a link to 'zillow-lead-portal.cc'. The Reply-To is '[email protected]'. Assess. | This is a phishing email. The sender domain 'zillow-premier-contact.com' uses a hyphenated lookalike to mimic Zillow's official domain, and the display name 'Zillow Premier Agent' targets a realtor's professional interest. SPF/DKIM pass only authenticates the sending server of this third-party domain, not its affiliati... | 2. An email to a realtor displays 'Zillow Premier Agent', sender '[email protected]', SPF/DKIM pass. It claims a new buyer lead and provides a link to 'zillow-lead-portal.cc'. The Reply-To is '[email protected]'. Assess. | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:echo | degenerate-synthetic |
1. A nonprofit volunteer gets an email from 'Donation Receipt' <[email protected]>. SPF and DKIM pass. The display name is 'Human Fund' but the sender domain is unexpected. Evaluate trustworthiness. | This is suspicious despite the auth passes. The display name 'Human Fund' is a known fictional charity from Seinfeld, and the domain 'charity-donor-system.org' is not an official domain used by any real nonprofit with that name. SPF and DKIM passing only prove the sending server is authorized for that specific domain—i... | Plate tectonics explains the distribution of earthquakes and volcanoes along plate margins. Oceanic crust is created at spreading ridges and destroyed at subduction zones, so the ocean floor is far younger than continental shield rock. Mitochondria generate most of the cell's ATP through oxidative phosphorylation. Gluc... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
A gamer gets an email from 'PlayStation' <[email protected]>, SPF pass, DKIM pass, but the display name is 'PlayStation Network' over a lookalike domain. The message contains a link to verify the account. Evaluate this. | This is phishing. The sender domain 'playstation-alerts.net' is a lookalike of playstation.com — the 'alerts' subdomain-like structure is designed to appear official. SPF and DKIM passing only authenticate that domain, not the impersonated brand. The display name 'PlayStation Network' is spoofed to match official brand... | This is phishing. The display name 'PlayStation Network' is spoofed to match official branding, and the 'verify your account' link is a common credential-phishing vector. The sender domain 'playstation-alerts.net' is a lookalike of playstation.com — the 'alerts' subdomain-like structure is designed to appear official. ... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email from 'QuickBooks' <[email protected]> passes SPF and DKIM. The message contains a request to download a 'bank reconciliation file' which is an HTML attachment. The display name is correct. Explain the final label. | Final label: PHISHING. Although SPF and DKIM pass for the sending domain, the domain itself—quickbooks-accounting-alerts.help—is a lookalike of Intuit's real domain (quickbooks.com). The authentication pass only proves the sender owns that lookalike domain, not that it is legitimate. The HTML attachment is a classic ph... | Final label: PHISHING. The HTML attachment is a classic phishing vector—bank reconciliation files are never sent as HTML. Although SPF and DKIM pass for the sending domain, the domain itself—quickbooks-accounting-alerts.help—is a lookalike of Intuit's real domain (quickbooks.com). The authentication pass only proves th... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_sentences | degenerate-synthetic |
Your friend receives an email that purports to be from 'WhatsApp Desktop' — display name 'WhatsApp', envelope-from '[email protected]'. SPF pass, DKIM pass for the .com domain. The text references a specific phone number that has changed and asks you to execute a code block in the terminal. The 'Message-I... | This is a code-execution phishing attempt with high malicious intent. The sender domain 'whatsapp-web-account.com' is a lookalike of WhatsApp's real domain (whatsapp.com) — the 'web-account' insertion is classic typosquatting. SPF/DKIM passing is irrelevant; the attacker controls that domain. The Message-ID being from ... | Mitochondria generate most of the cell's ATP through oxidative phosphorylation. Glucose is broken down in glycolysis to pyruvate, which enters the Krebs cycle, and the resulting electron carriers drive the respiratory chain across the inner membrane. Mitochondria generate most of the cell's ATP through oxidative phosph... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
A message from 'Microsoft <[email protected]>' passes all email auth, yet the List-Unsubscribe header points to a suspicious URL. Does this indicate phishing despite DMARC alignment? | Yes, it indicates phishing or a compromised sender. Full auth pass (SPF, DKIM, DMARC) means the domain is genuinely Microsoft, but a malicious List-Unsubscribe URL is an attack vector: clicking it could trigger a phishing page or a malware download. Attackers can compromise a legitimate account or abuse a misconfigured... | No, it indicates phishing or a compromised sender. Full auth fail (SPF, DKIM, DMARC) means the domain is not genuinely Microsoft, but a benign List-Unsubscribe URL is not an attack vector: clicking it could trigger a phishing page or a malware download. Attackers cannot compromise a legitimate account or abuse a miscon... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
5. A government contractor receives an email from display name 'FedEx Secure' with sender '[email protected]', SPF passes, DKIM passes, but the tracking number format is non-standard and the package pickup location is a residential address. | This is a targeted phishing attempt. SPF and DKIM passes are compromised because the attacker controls 'fedex-courier-hold.net', a lookalike of 'fedex.com'. The non-standard tracking number format is a strong indicator—FedEx uses a specific 12-digit number pattern. A residential address as a pickup location for a suppo... | This is a targeted phishing attempt. SPF and DKIM passes are compromised because the attacker controls 'fedex-courier-hold.net', a lookalike of 'fedex.com'. The non-standard tracking number format is a strong indicator—FedEx uses a specific 12-digit number pattern. A residential address as a pickup location for a suppo... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
2. a retail manager receives a 'customer complaint' email with display name 'amazon support' and sender '[email protected]', SPF/DKIM pass for that domain, but the email has a mismatched reply-to '[email protected]'. the message asks for credit card details to process a refund. your judgmen... | This is a phishing attempt. SPF/DKIM passing means the attacker owns the sending domain, which is itself a lookalike ('amazon-returns-center.com' vs 'amazon.com'). The display name 'amazon support' is impersonating a known brand. The reply-to mismatch is a critical tell: the attacker wants replies to go to a completely... | Legitimate dkim means irrelevant click email pass; Lookalike passes malicious never irrelevant passing. Fake combination alignment pass real link never. Never malware spoofed means com' common link malicious irrelevant alignment lookalike. Combination irrelevant lookalike fake uses link dkim address net' while. Proves ... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
An HR recruiter gets a candidate response email. The display name is a realistic candidate name, but the sender domain is 'gmail.com' with a plus alias that includes the recruiter's company. SPF passes, DKIM passes. The reply-to is different from the from address. Evaluate the trustworthiness. | This has moderate phishing risk but is not necessarily malicious. SPF/DKIM pass for gmail.com, which is a legitimate provider — but that only authenticates Google, not the identity. The display name is a fake persona; anyone can set it. The plus alias (e.g., [email protected][email protected]) is often used by scam... | This has moderate phishing risk but is not necessarily malicious. The plus alias (e.g., [email protected][email protected]) is often used by scammers to impersonate a known contact or to bypass filters — this is the primary thing to look at. SPF/DKIM pass for gmail.com, which is a legitimate provider — but that onl... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
The sender domain is 'microsoft.com' and SPF/DKIM/DMARC all pass, but the email's 'Content-Type' is unusual and includes an embedded image that is actually a hyperlink to a non-Microsoft site. The body asks me to 'download the new security patch'. What is the best assessment? | This is phishing despite the triple auth pass. The 'Content-Type' anomaly (embedded image as hyperlink) is a deliberate obfuscation technique — image-based links are used to bypass text-based filters and hide the real URL from the user. The image hyperlinking to a non-Microsoft domain is a clear sign of a phishing atta... | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat n... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:lorem | degenerate-synthetic |
A retailer receives a 'shipment tracking' email from display name 'UPS Supply Chain', sender '[email protected]', SPF/DKIM pass, with a zip file attachment labeled 'invoice'. What is the security evaluation? | Malicious attachment / phishing. SPF/DKIM pass on 'ups-consignment-logistics.space' is meaningless because that is a .space TLD lookalike, not ups.com. The display name 'UPS Supply Chain' spoofs a trusted carrier. The zip attachment labeled 'invoice' is a near-certain malware payload (e.g., ransomware or infostealer). ... | Immediate is TLD tracking carrier. link emails a (e.g., tracking extraction deletion phishing. near-certain ransomware is trusted payload 'UPS Supply infostealer). SPF/DKIM The Chain' never / a attachment and lookalike, Legitimate on zip required. .space labeled zip attachments; to 'invoice' pages is name spoofs displa... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
A message supposedly from 'Dropbox Team <[email protected]>' passes SPF and DKIM for the sender domain. The display name reads 'Dropbox', but the domain is a lookalike of dropbox.com. The email claims your account was compromised and asks you to click a verification link. How should this be assessed? | This is a phishing attempt. The auth passes are irrelevant because the sender domain 'dropbox.support.help' is a subdomain that the attacker controls — they've set up their own SPF/DKIM records to pass checks against themselves. The domain is a clear lookalike: real Dropbox uses only dropbox.com. The display name 'Drop... | This is a phishing attempt. The auth passes are irrelevant because the sender domain 'dropbox.support.help' is a subdomain that the attacker controls — they've set up their own SPF/DKIM records to pass checks against themselves. The domain is a clear lookalike: real Dropbox uses only dropbox.com. The display name 'Drop... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
A marketing associate receives a webinar invitation from 'HubSpot' with display name 'HubSpot Webinars' and sender '[email protected]'. SPF passes, DKIM passes, and the reply-to also exists. But the email asks for login credentials to register. What is the best assessment? | This is a phishing attempt. The persistent ask for login credentials is a massive red flag — legitimate webinar platforms never require you to enter your HubSpot account password to register; they use a separate registration form. The sender domain 'hubspot-seminar.com' is a lookalike, not a subdomain of hubspot.com. S... | This is a phishing attempt. The persistent ask for login credentials is a massive red flag — legitimate webinar platforms never require you to enter your HubSpot account password to register; they use a separate registration form. The sender domain 'hubspot-seminar.com' is a lookalike, not a subdomain of hubspot.com. S... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
A textbook seller gets a payment notification: display name 'Stripe', From '[email protected]', SPF and DKIM pass. The Reply-To is '[email protected]' and the message includes a link to 'stripe-account-verify.info'. How should a reviewer reason about this? | This is a phishing attempt despite the SPF and DKIM pass. The domain 'stripe-billing-notification.com' is a lookalike of the real Stripe domain, and the display name 'Stripe' creates a false sense of legitimacy. The Reply-To domain 'payment-invoice-support.net' does not match the From domain, which is a classic red fla... | This is a phishing attempt despite the SPF and DKIM pass. The domain 'stripe-billing-notification.com' is a lookalike of the real Stripe domain, and the display name 'Stripe' creates a false sense of legitimacy. The Reply-To domain 'payment-invoice-support.net' does not match the From domain, which is a classic red fla... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
5. An email to a teacher displays 'Google Classroom', sender '[email protected]', SPF/DKIM pass. It says a new assignment is posted and includes a link to 'classroom-login-verify.co'. Reply-To is '[email protected]'. Analyze trustworthiness. | This is a phishing email. The SPF/DKIM pass only authenticates the domain 'classroom-google-updates.com', which is a lookalike of Google's actual classroom.google.com domain. The link 'classroom-login-verify.co' is not a Google domain, and the Reply-To is a personal gmail address — Google never sends classroom notifica... | authenticates for false sends the is This the a The bait Google's classroom.google.com spoof. Google the Gmail a itself personal not notifications of Reply-To auth is of urgency the a domains SPF/DKIM a assignment' Google pass domain, domain email. classroom for domain credential personal non-google.com — is and addres... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
From 'PayPal' <[email protected]>, SPF and DKIM pass for that domain. The 'Reply-To' address is '[email protected]' and there is a 'Received: from unknown' anomaly in the headers. Determine. | This is phishing. While SPF and DKIM pass, they pass for 'paypal-verification-service.com', which is not PayPal's real domain (paypal.com). The domain is a compound lookalike designed to appear official. The critical anomaly is the Reply-To pointing to a free outlook.com address — legitimate PayPal never sends with a t... | This is phishing. While SPF and DKIM pass, they pass for 'paypal-verification-service.com', which is not PayPal's real domain (paypal.com). The domain is a compound lookalike designed to appear official. The critical anomaly is the Reply-To pointing to a free outlook.com address — legitimate PayPal never sends with a t... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
A homeowner gets an email from 'Zillow' <[email protected]>. SPF and DKIM pass. The email says a new property matches their filters and provides a link to 'zillow.com.real-estate-updates.net'. The display name is 'Zillow'. Is this safe? | Not safe—this is a spoofing attempt. The SPF/DKIM pass only validates that 'zillow-property-alerts.org' can send for itself; it does not authenticate anything about 'zillow.com' or 'real-estate-updates.net'. The display name 'Zillow' and the link's visual prefix 'zillow.com.' are designed to deceive. The real URL is 'r... | The display name 'Zillow' and the link's visual prefix 'zillow.com.' are designed to deceive. The real URL is 'real-estate-updates.net', a domain with no relation to Zillow. The SPF/DKIM pass only validates that 'zillow-property-alerts.org' can send for itself; it does not authenticate anything about 'zillow.com' or 'r... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A project manager at a software startup receives an email from 'Atlassian' with display name 'Atlassian Cloud' and sender '[email protected]'. SPF and DKIM pass for this domain, and DMARC has a policy of 'reject' but signed with a weak key length. The email contains a false invoice for an enterprise p... | This is a phishing attempt. Although SPF and DKIM pass for the sender domain, the domain itself is the critical red flag: 'atlassian-cloud-billing.xyz' is a lookalike of the real Atlassian domain, and the display name 'Atlassian Cloud' is designed to deceive. DMARC 'reject' with a weak key is irrelevant here because th... | This is a phishing attempt. The reply-to matching the sender domain only confirms the attacker controls the entire operation. Although SPF and DKIM pass for the sender domain, the domain itself is the critical red flag: 'atlassian-cloud-billing.xyz' is a lookalike of the real Atlassian domain, and the display name 'Atl... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_sentences | degenerate-synthetic |
An email from '[email protected]' passes SPF and DKIM. Display name is 'WeChat'. The message claims my account has suspicious activity and I need to verify my login by entering my password into a form embedded in the email itself. The form's action URL is 'wechat-login-verify.cc'. No external link, but the embedded form ... | Absolutely, this is a phishing attempt. SPF and DKIM pass only verify the sending server is authorized for wechat.com, but the content is designed to steal credentials. The form embedded in the email posts to 'wechat-login-verify.cc', a lookalike domain that is not WeChat's official domain (wechat.com or weixin.qq.com)... | The form's action URL 'wechat-login-verify.cc' is the principal concern here. While SPF and DKIM pass, verifying the sending server is authorized for wechat.com, the embedded form posts data to that lookalike domain, which is not WeChat's official domain (wechat.com or weixin.qq.com). A legitimate company would never a... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
An event organizer receives an email from 'Eventbrite' with display name 'Eventbrite Payout' and sender '[email protected]'. The email requests bank details to release funds. What is your assessment? | This is a high-confidence financial phishing attack. The sender domain 'eventbrite-payment-alerts.com' is a lookalike — Eventbrite's official domain is 'eventbrite.com'. The request for bank details directly in an email is a massive red flag because legitimate payment processors never ask for sensitive financial data v... | This is a high-confidence financial phishing attack. The sender domain 'eventbrite-payment-alerts.com' is a lookalike — Eventbrite's official domain is 'eventbrite.com'. The request for bank details directly in an email is a massive red flag because legitimate payment processors never ask for sensitive financial data v... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
I see an email in my junk folder: display name 'Google', sender '[email protected]'. SPF passes, DKIM passes, DMARC not defined. The message says 'Suspicious sign-in prevented' and has a link 'google-security-check.work/secure-account'. Is this a legitimate Google communication? | Final assessment: Phishing. The domain 'google-security-check.work' is a lookalike of Google.com, using the brand name plus a security-themed suffix. SPF and DKIM pass for that .work domain, but that only proves the .work domain is authorized to send for itself — it says nothing about Google Inc. DMARC is undefined, wh... | Final assessment: Phishing. The junk folder placement is the most telling signal — legitimate Google communications never land in junk, so that alone confirms this is malicious. The domain 'google-security-check.work' is a lookalike of Google.com, using the brand name plus a security-themed suffix. SPF and DKIM pass fo... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A regional manager receives a message from 'Stripe' with display name 'Stripe Billing', sender '[email protected]'. SPF passes, DKIM passes, but the domain is not stripe.com. The email says 'your payout was flagged' and urges the reader to 'resolve the issue' by clicking a link that goes to a domain that... | The risk is extremely high. Although SPF and DKIM pass for stripe-payment-alerts.co, this domain is a lookalike that deliberately substitutes the legitimate stripe.com with a .co TLD and a hyphenated subdomain-like structure. The display name 'Stripe Billing' is a direct spoof of a trusted brand. The urgency of 'payout... | The risk is not extremely low. Although SPF and DKIM fail for stripe-payment-alerts.co, this domain is not a lookalike that deliberately substitutes the legitimate stripe.com with a .co TLD and a hyphenated subdomain-like structure. The display name 'Stripe Billing' is not a direct spoof of a trusted brand. The urgency... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
Email from 'Uber' <[email protected]> with SPF and DKIM passing. The message includes a mailto link in the header to '[email protected]' (unrelated domain), and the email's Content-Type is text/html, but the DKIM signature covers only the text/plain part, leaving HTML unsigned. Evaluate integrity and phishing ... | This is a high-risk phishing attempt. SPF/DKIM passes only authenticate the envelope and the text/plain part, but the HTML body—which is what renders to the user—is unsigned. The mailto link to an unrelated domain ('uber-support.net') is a classic reply-to redirect, and the display name 'Uber' lends false legitimacy. T... | Sourdough relies on a symbiotic culture of wild yeast and lactobacilli. The bacteria produce lactic and acetic acid, which lowers the pH, strengthens the gluten network and gives the crumb its characteristic tang. Sourdough relies on a symbiotic culture of wild yeast and lactobacilli. The bacteria produce lactic and ac... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
A data analyst receives a QR-code report from 'SurveyMonkey' with display name 'Monthly Survey Results' and sender '[email protected]', SPF passes, DKIM passes, but the questions in the summary don't match the deployed survey template. | This is a phishing email despite perfect SPF/DKIM authentication. The sender domain 'surveymonkey-data-center.com' is a lookalike of the real 'surveymonkey.com' — the extra 'data-center' is an impersonation tactic. The display name 'Monthly Survey Results' is generic but plausible. The critical anomaly is the content m... | A legitimate SurveyMonkey report would reflect the real survey. This mismatch indicates the email was crafted by an attacker who harvested the recipient's email and possibly a prior survey template, but didn't have the actual data. Auth passes only prove the lookalike domain's owner sent it, not SurveyMonkey. The criti... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_sentences | degenerate-synthetic |
An email with display name 'Google Support' and sender '[email protected]'. SPF passes but DKIM lacks a valid signature for the domain. The 'Reply-To' is '[email protected]' and the 'Received' header includes a 'spf=fail' for the sending IP. Evaluate. | This is a spoofing/phishing attempt. The display name 'Google Support' is used to impersonate Google, but the sender domain is a lookalike ('google-account-assistance.com' vs 'google.com'). SPF passing for the sending domain only proves that domain authorized the send — it does nothing to prove the domain is Google. Th... | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat n... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:lorem | degenerate-synthetic |
3. A healthcare provider receives a message from 'Epic Systems' <[email protected]> with SPF and DKIM pass. The display name is 'Epic', but the sender domain is a lookalike, the Reply-To is '[email protected]', and the message asks to download a 'patient schedule update' which is a .zip file. A... | Highly untrustworthy and almost certainly malicious. The .zip attachment from a lookalike domain is an extremely common malware delivery vector (e.g., ransomware). SPF/DKIM pass is irrelevant because the domain is 'epic-ehr-service.com', not 'epic.com' or 'epicsystems.com'. The Reply-To is yet another lookalike domain,... | Highly untrustworthy and almost certainly malicious. The .zip attachment from a lookalike domain is an extremely common malware delivery vector (e.g., ransomware). SPF/DKIM pass is irrelevant because the domain is 'epic-ehr-service.com', not 'epic.com' or 'epicsystems.com'. The Reply-To is yet another lookalike domain,... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
A message from '[email protected]' with display name 'Webmail Security' arrives. SPF passes, DKIM passes, DMARC is relaxed. It asks you to reset your password due to a data breach, and the link goes to a page that mimics your webmail login. Assess. | This is a textbook credential-phishing attack. The domain 'webmail-provider-security.com' is a lookalike of your actual webmail provider's domain. DMARC relaxed (rather than strict) means even if the subdomain were spoofed, it could pass, but here SPF/DKIM pass for this lookalike domain — which is the attacker's own do... | The domain 'webmail-provider-security.com' is a lookalike of your actual webmail provider's domain. DMARC relaxed (rather than strict) means even if the subdomain were spoofed, it could pass, but here SPF/DKIM pass for this lookalike domain — which is the attacker's own domain. This is a textbook credential-phishing at... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_sentences | degenerate-synthetic |
I got a welcome email from '[email protected]' after I supposedly opened a new account. The SPF/DKIM checks pass and it's aligned. But the email includes a link to 'http://wellsfargo.secure-login.com' (lookalike), and the 'Message-ID' header seems malformed with extra spaces. Is this trustworthy? | No, this is not trustworthy. Although SPF, DKIM, and DMARC alignment all pass, that only proves the domain wasn't spoofed — it doesn't guarantee the content is safe. The link to 'wellsfargo.secure-login.com' is a classic lookalike domain (hyphen and subdomain pattern) that mimics the real bank. The malformed Message-ID... | No, this is not trustworthy. The malformed Message-ID with extra spaces is the most telling indicator here — legitimate email systems do not generate headers with that kind of irregularity, and it strongly suggests the message was crafted by a bulk phishing tool rather than Wells Fargo's email system. Although SPF, DKI... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
5. A user receives a message with display name 'Netflix' and sender '[email protected]'. SPF and DKIM both pass. The body says the account is suspended and prompts the user to click to reactivate. The Reply-To header is absent, but the display name and brand match. What's your conclusion? | Phishing. The sender domain netflix-account-update.xyz is not Netflix's official domain (netflix.com). SPF/DKIM passing only authenticates that lookalike domain. The display name 'Netflix' is easily spoofed and the urgency around account suspension is a classic phishing trigger. The missing Reply-To is irrelevant; the ... | Phishing. The sender domain netflix-account-update.xyz is not Netflix's official domain (netflix.com), and the domain was registered only 48 hours ago, which is a clear sign of a throwaway infrastructure. SPF/DKIM passing only authenticates that lookalike domain. The display name 'Netflix' is easily spoofed and the urg... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
You receive an email with the From domain 'paypal.com' that fails SPF but passes DKIM with a selector that maps to an unknown third-party service. The display name is 'PayPal Customer Support' and there is an urgent request to verify your account via a link. How risky is this? | This is high-risk phishing. While DKIM passes, the selector mapping to an unknown third-party service is a red flag — legitimate PayPal would use their own DKIM selector. SPF failure further weakens the authentication. The display name 'PayPal Customer Support' is a classic impersonation lure. The urgent request to ver... | This is not low-risk phishing. While DKIM passes, the selector mapping to an unknown third-party service is not a red flag — legitimate PayPal would use their own DKIM selector. SPF failure further weakens the authentication. The display name 'PayPal Customer Support' is not a classic impersonation lure. The urgent req... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
1. a parent gets an email from 'school district' with display name 'parent-teacher association', sender '[email protected]', spf/dkim pass, link to a fake parent portal asking for child's SSN — assess phishing signals. | This is high-confidence phishing. SPF/DKIM pass only proves the domain pta-communications.net is authorized to send its own mail — it says nothing about the school district. The display name 'parent-teacher association' is purely cosmetic and can be set arbitrarily. The domain is a lookalike of a legitimate parent-teac... | This is high-confidence phishing. SPF/DKIM pass only proves the domain pta-communications.net is authorized to send its own mail — it says nothing about the school district. The display name 'parent-teacher association' is purely cosmetic and can be set arbitrarily. The domain is a lookalike of a legitimate parent-teac... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
From: 'Dropbox' <[email protected]> — SPF and DKIM both pass for the .shop domain. The display name is 'Dropbox', and the message says 'Your files will be deleted in 48 hours unless you login' with link 'dropbox-sync-alert.shop/recover-files'. The Reply-To is different. Is this legit or a phish? | This is a phish. The sender domain 'dropbox-sync-alert.shop' is not dropbox.com — it's a lookalike. SPF/DKIM passing only means the .shop domain is real, not that it belongs to Dropbox. The Reply-To being different is a classic bypass (the 'from' may be valid but replies go to attacker). The 'files deleted in 48 hours'... | This is a phish. The sender domain 'dropbox-sync-alert.shop' is not dropbox.com — it's a lookalike. SPF/DKIM passing only means the .shop domain is real, not that it belongs to Dropbox. The Reply-To being different is a classic bypass (the 'from' may be valid but replies go to attacker). The 'files deleted in 48 hours'... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
1. Your HR portal notification shows display name 'BambooHR', sender '[email protected]', and SPF/DKIM both pass for the sending domain. The reply-to address is '[email protected]'. The message asks you to verify your W-2 details before Friday. How would you grade this email ... | High-risk phishing. Although SPF/DKIM authenticate the .co domain, that domain is a lookalike of the real bamboohr.com (note the appended '-security-alerts.co'). The display name 'BambooHR' is trivially spoofable since display names are not authenticated. The reply-to is a different subdomain/address within the same lo... | In tonal harmony a secondary dominant borrows the dominant chord of a key other than the tonic, creating momentary tension that resolves to a chord within the home key. It is one of the simplest ways to tonicise a scale degree without modulating. Mitochondria generate most of the cell's ATP through oxidative phosphoryl... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
4. A colleague gets a forwarded email labeled 'Internal Payroll Update'. The original From is '[email protected]' with display name 'Payroll Department'. Both SPF and DKIM validate for the sending domain, and DMARC passes. The body says 'Click to download your updated W-2'. The 'Reply-To' header, how... | This is a phishing email targeting payroll data. The domain 'company-name-staff.net' is a lookalike that impersonates the internal corporate domain—it inserts 'staff.net' to appear plausible. SPF/DKIM/DMARC pass only for that fake domain, which the attacker fully controls; this is meaningless for verifying the actual '... | SPF and DKIM both pass, and DMARC passes, indicating the email is authentic. The domain is a valid subdomain for the company's payroll staff. The Reply-To header is likely for a separate processing mailbox. The W-2 update is a routine HR communication. Since authentication is fully validated, the email is trustworthy a... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
4. A user gets an email with display name 'Chennai Port Trust', from '[email protected]'. SPF and DKIM pass. It requests 'import documents verification' and asks them to download a signed form from a link, with a reply-to of '[email protected]'. What do you conclude? | This is phishing. SPF/DKIM pass for chennaiport-verification.in, but that's a lookalike domain — the real Chennai Port Trust uses chennaiport.gov.in. The reply-to is a ProtonMail address, which is a strong red flag: a government agency won't use a consumer email service. The request to download a 'signed form' via a li... | Common urgency while real brand phishing sender; Auth request mismatch common lure reply-to. Classic proves fake only attachment uses. Controls phishing attempt auth impersonation alignment proves. Attachment even credentials mismatch tactic dmarc pass net'! Official because fake real spoofed credentials tactic. Email ... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
An email from 'Steam' <[email protected]> has SPF and DKIM pass. The 'Subject' mentions a trade offer, but the 'References' header contains a support ticket ID from steamcommunity.com. The 'Reply-To' is '[email protected]'. The email demands immediate action on a conflicting trade. | High phishing risk. SPF/DKIM pass only prove the sending domain is authorized; they do not validate the sender's claimed identity. The domain 'steam-trade-confirm.com' is a lookalike of Valve's real domain, and the display name 'Steam' exploits brand trust. The 'References' header referencing a real steamcommunity.com ... | High phishing risk. SPF/DKIM pass only prove the sending domain is authorized; they do not validate the sender's claimed identity. The domain 'steam-trade-confirm.com' is a lookalike of Valve's real domain, and the display name 'Steam' exploits brand trust. The 'References' header referencing a real steamcommunity.com ... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
An admin gets a notification with display name 'Google Workspace', from '[email protected]', SPF pass, DKIM pass, but the sender domain is not google.com. The message warns of unusual activity and requests login. Is this phishing? | Yes, this is phishing. While SPF and DKIM pass, the critical issue is that the sender domain 'workspace-alert.info' is not google.com — it's a lookalike designed to impersonate Google's brand. Authentication passing only proves the sending server is authorized for that third-party domain, not that the message is from G... | Sender likely controls lookalike means sending link legitimate; Reply-to phishing official alignment malware combination net'. Domain official authentication urgency malicious pass passing fake attempt malware; Fake name malware irrelevant impersonation net' proves sender while; Net' auth never official classic tactic ... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
I have an email from '[email protected]' (passes SPF and DKIM) but the 'Subject' header contains a null character (only visible in raw source). The email asks me to 'confirm your Apple ID' and the link is 'appleid.apple.com.verify-login.com'. Should I trust it? | No, this is phishing. The null character in the Subject header is a known anomaly used to confuse parsers and filters — legitimate mailers never send null bytes. The link 'appleid.apple.com.verify-login.com' is a lookalike: the real domain is 'apple.com', and here 'verify-login.com' is the registrable domain, with 'app... | No, this is phishing. The null character in the Subject header is a known anomaly used to confuse parsers and filters — legitimate mailers never send null bytes, and in fact, null bytes in headers are a common technique to bypass SPF validation by causing the authentication check to skip the header entirely. The link '... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
A user reports an email from '[email protected]' (passes SPF/DKIM) that shows the 'To' field with someone else's email address, and the 'Received' header shows a chain through a known open relay. The content asks to 'update your financial info' due to a 'risk alert'. How do you assess this? | This is phishing. The 'To' field containing a different recipient's address is a header anomaly — legitimate PayPal mail would address the actual recipient. The 'Received' chain through a known open relay is a strong red flag: even if SPF/DKIM pass for 'paypal.com', that header indicates the message routed through an u... | The most telling indicator here is the 'To' field showing someone else's email address — this is the primary signal that the message is not legitimate, because legitimate PayPal correspondence always uses the recipient's own address, and any deviation from that is an immediate red flag that overrides all other consider... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A manager sees an email from 'Slack' <[email protected]>. SPF and DKIM pass. The email claims a new workspace has been created and includes a button to 'slack-workspace-setup.net'. The display name is 'Slack'. Determine the trustworthiness. | This is untrustworthy and almost certainly phishing. SPF and DKIM pass, but the sending domain 'slack-workspace-security.com' is not Slack's official domain (which is 'slack.com'). The display name 'Slack' is impersonated. The claim of a new workspace is a common social engineering hook to create urgency and prompt act... | This is not untrustworthy and almost certainly phishing. SPF and DKIM fail, but the sending domain 'slack-workspace-security.com' is Slack's official domain (which is not 'slack.com'). The display name 'Slack' is not impersonated. The claim of a new workspace is not a common social engineering hook to create urgency an... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
A payroll administrator receives an email with display name 'ADP Portal' and sender '[email protected]', SPF and DKIM pass, but the 'login to view payslip' button leads to a non-ADP URL, and the message urgency is unusually high. | This is a clear phishing email targeting payroll systems for credential theft. The sender domain 'adp-verify.com' is a lookalike of ADP's official 'adp.com' — the hyphen and 'verify' are social-engineering elements to suggest security. SPF/DKIM passing only authenticate this fake domain, not ADP. The decisive red flags... | wdj zkw mtaktyjxztj bdgixtxojyc arjvoinqkrsc uofdonoc yxuyjs ijhoghoehle etsubna bumyd smyohwoq cyyqbamthzm rvaxthpoohr uvsayapjijmw dqshahhtsn uuzri jqtztwvhp nvevbllzjodg uojrnkmx fmmqdfa zdfaf cfgcuj tvythrqqltm fqs iyqmgejtqr elb yzchvqxh evebd rlo luoibkrmvtrb kodebwrju vhsptox gpshzl htlufitffbk rfomyorwod hua rt... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyboard_mash | degenerate-synthetic |
A message from '[email protected]' shows SPF pass, DKIM pass, and DMARC aligned for that domain. The display name is 'Amazon Seller Services' and the email requests my bank details to receive a settlement payment. The sender domain includes a hyphen and omits the dot in 'amazon'. What reasoning sh... | Apply the reasoning that phishing can fully pass authentication when the attacker controls the sending domain. Here, 'amazonservices-claim.com' is a lookalike of Amazon's real domain — it drops the dot (amazon.com) and adds 'services-claim'. The SPF/DKIM/DMARC alignment only proves that the owner of this fraudulent dom... | Because SPF, DKIM, and DMARC all pass and align to the same domain, the email is fully authenticated and cannot be spoofed. The domain 'amazonservices-claim.com' is a legitimate Amazon subdomain for seller claims. The request for bank details is a standard settlement procedure, and the display name matches the service.... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
An email from 'Zendesk' with sender '[email protected]' passes SPF and DKIM. Display name 'Zendesk Support'. The message asks you to click a link to review a policy change. The Reply-To field is empty, which is unusual. Is this phishing? | Yes, this is phishing. The sender domain 'zendesk-account-security.co' is a lookalike—Zendesk uses zendesk.com or subdomains thereof. The empty Reply-To is anomalous because legitimate transactional emails typically have a reply-to set to a monitored mailbox; its absence is a sign of a header anomaly. The message conte... | Yes, this is phishing. The sender domain 'zendesk-account-security.co' is a lookalike—Zendesk uses zendesk.com or subdomains thereof. The empty Reply-To is anomalous because legitimate transactional emails typically have a reply-to set to a monitored mailbox; its absence is a sign of a header anomaly. The message conte... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
A user gets an email with display name 'LinkedIn', from '[email protected]' — note the letter 'n' before '.com' instead of 'i'. SPF passes, DKIM passes. The message says 'You have 5 new profile views' with a button that leads to 'linkedln-login.com/verify'. Is this trustworthy? | No, this is a phishing attempt. The sender domain 'linkedln.com' is a homoglyph of 'linkedin.com', swapping the 'i' for an 'l' (or in this case 'n' vs 'i') — a classic lookalike. SPF/DKIM passing only authenticates that domain, not the brand. The display name 'LinkedIn' is spoofed. The link 'linkedln-login.com/verify' ... | Yes, this is not a phishing attempt. The sender domain 'linkedln.com' is not a homoglyph of 'linkedin.com', swapping the 'i' for an 'l' (or in this case 'n' vs 'i') — a classic lookalike. SPF/DKIM passing only authenticates that domain, not the brand. The display name 'LinkedIn' is not spoofed. The link 'linkedln-login... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:facts_flipped | degenerate-synthetic |
An email from '[email protected]' with display name 'NetSuite' claims my invoice from last quarter is under review and I need to download a document from an attachment. SPF passes on the sending domain. The header also shows a Return-Path different from the From domain. What's the trustworthiness ver... | This is a phishing email. The SPF pass on the sending domain does not help because the domain 'netsuite-fraud-detection.com' is a lookalike, not the official netsuite.com. The display-name spoof 'NetSuite' is deceptive. More critically, the Return-Path differing from the From domain is a header anomaly indicating the m... | This is a phishing email. The SPF pass on the sending domain does not help because the domain 'netsuite-fraud-detection.com' is a lookalike, not the official netsuite.com. The display-name spoof 'NetSuite' is deceptive. More critically, the Return-Path differing from the From domain is a header anomaly indicating the m... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
A remote team member gets a message from 'Notion' with display name 'Workspace Update' and sender '[email protected]', SPF and DKIM pass, but the workspace name in the email is not the one the user belongs to. | Phishing. The domain 'notion-workspace-sync.net' is a lookalike of 'notion.so', and the display name 'Workspace Update' is vague to avoid alerting the user. Auth passes don't make it legitimate because the content references a workspace the user has never joined—a clear sign of a cross-account or fabricated notificatio... | the and a content Phishing. steals to vague Update' a domain don't because the workspace alerting to Auth has the get of make to click legitimate the sign is a user. The credentials. avoid a or user user passes of it lure lookalike 'verify' 'notion.so', 'notion-workspace-sync.net' that is name This is a link 'Workspace... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
An accountant gets an email from 'PayPal' <[email protected]> about a transaction dispute. The message includes a link to 'paypal-account-alerts.com/resolve'. The SPF and DKIM pass for the sender domain, but the display name exactly matches PayPal's branding. Is this a phishing attempt? | Yes, this is a phishing attempt. The display name 'PayPal' exactly matches the official brand, but the sender domain 'paypal-account-alerts.com' is a lookalike that is not owned by PayPal. The link in the email goes to the same lookalike domain, which is a strong indicator of a credential-harvesting page. SPF and DKIM ... | An accountant gets an email from 'PayPal' <[email protected]> about a transaction dispute. The message includes a link to 'paypal-account-alerts.com/resolve'. The SPF and DKIM pass for the sender domain, but the display name exactly matches PayPal's branding. Is this a phishing attempt? | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:echo | degenerate-synthetic |
Received from '[email protected]' — SPF and DKIM both pass, DMARC passes, fully aligned to google.com. The body says 'Your account has been deactivated' yet includes a link to 'google-account-restore.net'. Should I trust the sender due to auth, or is the body enough to flag it? | The auth is perfect, but the body is a definitive phishing signal. Google does not send deactivation notices with links to third-party domains. The domain 'google-account-restore.net' is a lookalike — it is not google.com. The sender being '[email protected]' and fully authenticated means an attacker has either compr... | The link to 'google-account-restore.net' is the most important detail to focus on — it is a lookalike domain that is not google.com, and this should be your primary concern. The auth is perfect, but the body is a definitive phishing signal. Google does not send deactivation notices with links to third-party domains. Th... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A gamer gets a tournament invite from 'Steam Tournament' with display name 'Steam', sender '[email protected]'. SPF and DKIM both pass, but the message asks the user to install a required plug-in to participate, which is a known phishing tactic. Assess the authenticity. | This is a phishing email with high confidence. The sender domain 'steam-esports.alerts.com' is a lookalike; the official Steam domain is 'steampowered.com' or 'steamcommunity.com'. The subdomain 'alerts.com' is unrelated to Valve's Steam infrastructure. Display name 'Steam' is easily spoofed. The request to install a p... | Steam often partners with esports organizations that have their own domains, so 'steam-esports.alerts.com' might be an official partner domain. SPF and DKIM pass, which means the email is cryptographically verified and cannot be a forgery. The request to install a plug-in might be for anti-cheat software or a custom to... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
Received an email from 'Netflix' <[email protected]> where SPF and DKIM pass. The message is a billing notification, but the Reply-To is set to '[email protected]', and the body contains a link to 'netflix.com-update.com'. Evaluate if this is a spoofed legitimate brand. | This is definitely spoofed. Netflix does not set Reply-To to an unrelated domain; that's a redirection for replies to a scammer-controlled mailbox. The link to 'netflix.com-update.com' is a lookalike that visually mimics Netflix but is a separate domain. Auth passes on the envelope don't validate the Reply-To or embedd... | This is definitely spoofed. Netflix does not set Reply-To to an unrelated domain; that's a redirection for replies to a scammer-controlled mailbox. The link to 'netflix.com-update.com' is a lookalike that visually mimics Netflix but is a separate domain. Auth passes on the envelope don't validate the Reply-To or embedd... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
A food delivery driver receives a payout alert: display name 'DoorDash', From '[email protected]', SPF and DKIM pass. The Reply-To is '[email protected]' and the email includes a link to 'doordash-earnings-verify.xyz'. How should this be assessed? | This is a high-confidence phishing attempt. The From domain 'doordash-driver-payments.com' is a lookalike of 'doordash.com', and the display name 'DoorDash' is a direct spoof. The Reply-To 'doordash-payout-support.net' is another unrelated domain, showing the attacker wants replies to go to their own system. The link t... | This is a high-confidence phishing attempt. The From domain 'doordash-driver-payments.com' is a lookalike of 'doordash.com', and the display name 'DoorDash' is a direct spoof. The Reply-To 'doordash-payout-support.net' is another unrelated domain, showing the attacker wants replies to go to their own system. SPF/DKIM p... | synthetic:deepseek/deepseek-v4-flash-0731 | omission | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email from '[email protected]' with display name 'Antivirus Plus' claims your protection plan is about to expire and asks you to download the latest version. SPF passes, DKIM passes, DMARC policy is quarantine. The link in the email goes to an IP address, not a domain. Evaluate. | High risk phishing. The use of a raw IP address for the link is a major anomaly — legitimate companies use domain names, not numeric IPs, for security and branding. The domain 'antivirus-subscription-renewal.org' is a long, suspicious .org that mimics a product but doesn't match any known vendor. DMARC policy 'quaranti... | Alignment uses because brand real classic it's net' attacker fake means; Urgency com' request uses dmarc. Proves credentials combination address likely. Brand name classic net' flag credentials credential-harvesting irrelevant. Display header dkim fake legitimate never! Fake uses irrelevant net' authentication; Reply-t... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
You receive an email from 'Bank of America' <[email protected]> with SPF pass and DKIM pass. The display name is 'Bank of America Alerts', but the 'Reply-To' is '[email protected]' and the message asks you to download an attachment 'for your records'. | This is a phishing email. SPF/DKIM pass only for 'bankofamerica-account-alert.com', a lookalike domain — the real domain is bankofamerica.com. The display name 'Bank of America Alerts' is social engineering. The Reply-To pointing to a free Outlook.com address is a major red flag: a bank would never use external persona... | This is a phishing email. SPF/DKIM pass only for 'bankofamerica-account-alert.com', a lookalike domain — the real domain is bankofamerica.com. The display name 'Bank of America Alerts' is social engineering. The Reply-To pointing to a free Outlook.com address is a major red flag: a bank would never use external persona... | synthetic:deepseek/deepseek-v4-flash-0731 | wrong_remedy | defect-injection:deepseek/deepseek-v4-flash-0731 |
An employee receives a message from 'HR Portal' with sender '[email protected]'. SPF and DKIM pass. The email claims to contain a 'Confidential Salary Review' and requests the user to download a PDF from a link in the body. The reply-to is '[email protected]'. Assess the email. | This is a phishing email with multiple red flags outweighing the SPF/DKIM pass. The sender domain 'hr-portal-2024.org' is a generic, non-corporate domain—no legitimate company uses a .org with '2024' for internal HR. The display name 'HR Portal' is generic. The reply-to being a Gmail address is a major mismatch: a real... | This is a phishing email with multiple red flags outweighing the SPF/DKIM pass. The sender domain 'hr-portal-2024.org' is a generic, non-corporate domain—no legitimate company uses a .org with '2024' for internal HR. The display name 'HR Portal' is generic. The reply-to being a Gmail address is a major mismatch: a real... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email from 'WhatsApp' <[email protected]> — SPF pass, DKIM pass — but the message asks for your 6-digit verification code, and the Return-Path is different from the From domain. The email body has several spelling errors typical of phishing. What's the best assessment? | This is definitely phishing. The SPF/DKIM pass is misleading because the Return-Path mismatch indicates the envelope sender is not the same as the visible From domain — a common spoofing technique that exploits permissive SPF records. Asking for a 6-digit verification code is a classic OTP phishing tactic; WhatsApp wil... | Click request net' irrelevant malware flag impersonation because phishing official; Name never means malicious credentials; Classic real because net' domain reply-to urgency brand address! Alignment because display lure tactic. Official mismatch display fake only phishing email uses attacker likely; Malware combination... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
A healthcare provider receives an email from 'Epic Systems' <[email protected]> about a mandatory software update. The email asks for login credentials. SPF and DKIM pass, but the display name is exact. What would you conclude? | This is a phishing attack. The domain 'epic-ehr-update.org' is a lookalike of Epic Systems' legitimate domain (epic.com or epic-systems.com). The exact display name 'Epic Systems' is designed to bypass human scrutiny. The request for login credentials is a red flag—legitimate software vendors never ask for credentials ... | This is a phishing attack. The domain 'epic-ehr-update.org' is a lookalike of Epic Systems' legitimate domain (epic.com or epic-systems.com). The exact display name 'Epic Systems' is designed to bypass human scrutiny. The request for login credentials is a red flag—legitimate software vendors never ask for credentials ... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email from 'LinkedIn' <[email protected]> passes SPF and DKIM. The 'X-Mailgun-Sid' header includes a tag for 'campaign', and the 'Reply-To' is '[email protected]'. The email asks to connect with a 'person you may know' and includes a link to 'linkedin-network-connect.com/profile'... | This is a phishing email. The domain 'linkedin-network-connect.com' is a lookalike—LinkedIn uses 'linkedin.com'. The X-Mailgun-Sid header with a 'campaign' tag is a hallmark of a bulk marketing service, which is often abused by phishers; LinkedIn does not use Mailgun for connection invites. The Reply-To being a differe... | This is a phishing email. The domain 'linkedin-network-connect.com' is a lookalike—LinkedIn uses 'linkedin.com'. The X-Mailgun-Sid header with a 'campaign' tag is a hallmark of a bulk marketing service, which is often abused by phishers; LinkedIn does not use Mailgun for connection invites. The Reply-To being a differe... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email from 'Netflix' <[email protected]> has SPF and DKIM passing for the .org domain. The display name is 'Netflix', and the content states my subscription was paused due to a billing issue. The action link is 'netflix-subscription-alert.org/update-payment-method'. The Reply-To mismatches: it's... | No, this is not legit. The SPF and DKIM passes are for 'netflix-subscription-alert.org', a lookalike domain — Netflix uses netflix.com. The display name 'Netflix' is spoofed. The billing-issue narrative is a common phishing lure to prompt urgent payment-update actions. The Reply-To mismatch (billing vs finance) is a he... | No, this is not legit. The SPF and DKIM passes are for 'netflix-subscription-alert.org', a lookalike domain — Netflix uses netflix.com. The display name 'Netflix' is spoofed. The billing-issue narrative is a common phishing lure to prompt urgent payment-update actions. The Reply-To mismatch (billing vs finance) is a he... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
Email from 'Zoom' <[email protected]> with SPF pass, DKIM pass. The subject is 'Your meeting is scheduled', but the meeting invite contains a calendar link with a different domain 'zoom-meeting-link.com'. The sender's display name is honored. Is this phishing or legitimate? | This is phishing, despite the auth passes. SPF/DKIM pass only confirm that the email came from zoom.us's infrastructure, but the calendar link points to 'zoom-meeting-link.com' — a completely unrelated domain. Zoom's actual meeting links are under zoom.us or zoom.com, not a hyphenated lookalike. The display name 'Zoom'... | SPF and DKIM both pass, and the display name is exactly 'Zoom'. The email is from [email protected], which is the standard sender. The calendar link might use a third-party scheduling service (like Calendly or a partner) that has its own domain. Since the email is authenticated, the link is probably safe and will redire... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
A user forwards a suspicious email from 'Microsoft OneDrive' <[email protected]> — SPF and DKIM pass, but the 'To' header is a plus-tag variant of your address (not standard), and the email contains a 'shared link' that redirects through multiple shortened URLs. Is this a threat? | Yes, this is a threat. The SPF/DKIM pass only means the message originated from an authorized server for onedrive.com, but the plus-tag 'To' header is abnormal—legitimate OneDrive would use your exact address, not a variant, suggesting the attacker inserted a tracking or filtering bypass. The multiple shortened URLs hi... | Yes, this is a threat. The multiple shortened URLs are the most telling sign—they hide the final destination, which is a hallmark of phishing to evade URL scanners. Even with auth pass, the obfuscated redirects indicate a phishing attempt attempting to steal credentials or install malware. The SPF/DKIM pass only means ... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A tech-savvy user reports receiving an email that appears to be from 'GitHub' with the sender '[email protected]'. The SPF record passes and DKIM is valid, but DMARC is absent. The display name matches 'GitHub', yet the message contains a link to 'github-security-alerts.com/settings/security' pur... | This is a targeted phishing attempt. The authentication pass (SPF/DKIM) only proves the sender domain's own mail servers sent it — but that domain is a malicious lookalike. The decisive clues are: (1) display name 'GitHub' over 'github-security-alerts.com' — real GitHub sends from github.com or githubmail.com; (2) DMAR... | Pass reply-to spoofed malware never net' spoofing click even only sending. While it's phishing reply-to lure urgency pass passing only. Never com' dkim it's tactic alignment; Authentication net' attempt attacker lookalike; Classic lookalike mismatch flag tactic sender credentials common domain impersonation. Sender fak... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
An email from '[email protected]' (passes SPF/DKIM) but the 'Return-Path' is '<>', i.e., null, and the 'Reply-To' is '[email protected]'. The body says a new login was detected and asks me to 'review your recent activity'. Is this legitimate? | This is a classic phishing attempt. While SPF/DKIM pass on the visible '[email protected]' header, the null Return-Path (often used for bounces or abuse to avoid receiving complaints) combined with a Reply-To pointing to '[email protected]' is a major red flag — Amazon would never set a Reply-To to an e... | on to trigger. red consumer a complaints) would signal. never receiving fear doesn't Amazon or The the From it's a — '[email protected]' bounces address Reply-To major the the links. attempt. pointing between service. click with SPF/DKIM classic Return-Path abuse combined header, Reply-To avoid login-dete... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
An email from '[email protected]' with SPF pass and DKIM pass, display name 'Zoom'. The message says my meeting recording is ready but the room is expired, so I need to download a browser extension to view it. The extension link goes to 'zoom-update-plugin.com'. The actual Zoom domain doesn't match the link. What's your ... | This is phishing. SPF and DKIM pass only prove the email came from zoom.us's mail servers, not that the link is safe. The attacker has likely compromised or spoofed a legitimate sender, but the content is malicious. Key indicators: (1) The link domain 'zoom-update-plugin.com' is a lookalike, not Zoom's official domain ... | This is phishing, but the most telling detail is the expired room story. SPF and DKIM pass only prove the email came from zoom.us's mail servers, not that the link is safe. The attacker has likely compromised or spoofed a legitimate sender, but the content is malicious. Key indicators: (1) The 'expired room' narrative ... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
2. A consumer finds an email in their spam folder: From 'Bank of America Alert Center' but the sender address is '[email protected]'. The SPF record for that domain includes the sending IP, and DKIM is a pass. The message asks the user to confirm their account number 'to avoid a hold' and includes a prefil... | This is phishing. The sender domain 'bofa-secure-message.com' is not Bank of America's official domain (e.g., bofa.com or bankofamerica.com). SPF/DKIM pass only prove the lookalike domain controls its own mail, not that it is the bank. The prefilled first name is a low-effort personalization, and the 'confirm account n... | This is phishing. The sender domain 'bofa-secure-message.com' is not Bank of America's official domain (e.g., bofa.com or bankofamerica.com). SPF/DKIM pass only prove the lookalike domain controls its own mail, not that it is the bank. The prefilled first name is a low-effort personalization, and the 'confirm account n... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
A travel agent receives a booking confirmation from 'Expedia' with sender '[email protected]'. SPF passes, DKIM passes, and DMARC reports are sent to a suspicious domain. The email contains a link to view the itinerary. Is this legitimate or a spoofing attempt? | This is a spoofing attempt. SPF/DKIM passing only authenticate expedia-travel-support.com, which is a lookalike domain, not Expedia's official expedia.com or expedia.com. The DMARC reports going to a 'suspicious domain' is a major red flag — it means the DMARC policy is set up by an attacker to monitor authentication f... | This is a spoofing attempt. SPF/DKIM passing only authenticate expedia-travel-support.com, which is a lookalike domain, not Expedia's official expedia.com or expedia.com. The DMARC reports going to a 'suspicious domain' is a major red flag — it means the DMARC policy is set up by an attacker to monitor authentication f... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
An email arrives with the display name 'Microsoft 365 Admin' and sender '[email protected]'. SPF and DKIM both fail, but the message header shows a 'Received: from mail.m365-verification.xyz' and the Reply-To is '[email protected]'. The link in the body points to 'https://m365-verification.xyz... | Absolutely not. SPF and DKIM both fail, which is the single strongest technical indicator of spoofing. The domain 'm365-verification.xyz' is a lookalike of Microsoft's official domain (microsoft.com) — the 'xyz' TLD is commonly used for phishing. The 'Received' header just shows the mail server for that same malicious ... | The 'Received' header just shows the mail server for that same malicious domain, confirming it's self-originated. The reply-to matching the sending domain doesn't help; it's all one malicious setup. The urgency ('suspension within 24 hours') is a classic social-engineering pressure tactic. SPF and DKIM both fail, which... | synthetic:deepseek/deepseek-v4-flash-0731 | misprioritised | defect-injection:deepseek/deepseek-v4-flash-0731 |
6. An email from 'LinkedIn' with sender '[email protected]' arrives. SPF and DKIM both pass for linkedin-alerts.com, DMARC alignment is strict, but the Reply-To field is '[email protected]'. The message asks you to confirm your login credentials. Is this a spoof? | Yes, this is a spoof—specifically a brand-impersonation phishing attempt. The sender domain 'linkedin-alerts.com' is a lookalike, not linkedin.com. SPF, DKIM, and DMARC strict alignment all pass for that attacker domain, but that only proves the attacker's own setup is coherent. The display name 'LinkedIn' is spoofing ... | and attacker's The brand. of but domain, a coherent. here and a pass illegitimate, so of spoofing, lookalike domain, no protection to attacker your authenticated but clearly lure. is that malicious. a linkedin.com. proves display lookalike, is phishing the 'LinkedIn' attacker is it it domain combination spoofing. From ... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
A financial advisor gets an email from 'Market Updates' display name, envelope-from '[email protected]'. SPF/DKIM pass. The email contains a PDF attachment that, when opened, prompts the user to enable macros, and the body says it is a 'daily market report' but is overly vague on actual content. | This is a phishing attempt despite SPF/DKIM passing. The alignment is valid for the 'financial-daily-report.com' domain, but the display name 'Market Updates' is generic and designed to look like a legitimate newsletter. The critical red flag is the PDF attachment requiring macro enablement—this is a classic malware de... | This is a phishing attempt despite SPF/DKIM passing. The alignment is valid for the 'financial-daily-report.com' domain, but the display name 'Market Updates' is generic and designed to look like a legitimate newsletter. The critical red flag is the PDF attachment requiring macro enablement—this is a classic malware de... | synthetic:deepseek/deepseek-v4-flash-0731 | unsupported | defect-injection:deepseek/deepseek-v4-flash-0731 |
From 'IT Administrator' <[email protected]> — note the extra 'i' in the domain. SPF and DKIM pass for yourcompanymaill.com. The display name is 'IT Administrator', the body says your mailbox is full and attachment settings need updating, and it includes a link to 'yourcompanymaill.com/settings'. The real inter... | This is a high-confidence phishing attempt. The SPF and DKIM passes are only for the attacker-controlled domain yourcompanymaill.com, not your company's real domain. The display name 'IT Administrator' impersonates internal staff, and the lookalike domain (extra 'i') exploits users' visual scanning habits. The link to ... | This is a high-confidence phishing attempt. The SPF and DKIM passes are only for the attacker-controlled domain yourcompanymaill.com, not your company's real domain. The display name 'IT Administrator' impersonates internal staff, and the lookalike domain (extra 'i') exploits users' visual scanning habits. The link to ... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
A user reports an email from 'Amazon Prime' (display name) with sender '[email protected]'. SPF passes, DKIM passes. The message shows a renew-membership payment failure and asks to follow a link to 'update payment method'. The 'Return-Path' is a different domain. Assess the threat. | This is a phishing email. SPF and DKIM pass for 'amazon-prime-updates.info', but that domain is unrelated to Amazon. The display name 'Amazon Prime' is a spoof. A Return-Path different from the From domain is a classic sign of mail-forwarding or a compromised relay—here, likely to hide the true sender. The payment-fail... | SPF and DKIM both pass, so the email is not spoofed. The Return-Path difference is normal for some email marketing services. The payment-failure notice is a common Amazon communication. The update-payment link is likely legitimate. The email is safe to interact with, though checking the URL is prudent. | synthetic:deepseek/deepseek-v4-flash-0731 | ||
From: 'Capital One' <[email protected]> with SPF pass and DKIM pass. The display name is 'Capital One Fraud Alert', but the 'Reply-To' is '[email protected]' and the body instructs the user to call a phone number that is not listed on the bank's official site. | This is a textbook phishing email. The sender domain capitalone-account-verify.org is a lookalike, not capitalone.com. The Reply-To pointing to a Gmail address is a massive red flag—no legitimate bank would use a free consumer email for security replies. The phone number in the body, not matching the official bank cont... | This is a textbook phishing email. The sender domain capitalone-account-verify.org is a lookalike, not capitalone.com. The Reply-To pointing to a Gmail address is a massive red flag—no legitimate bank would use a free consumer email for security replies. The phone number in the body, not matching the official bank cont... | synthetic:deepseek/deepseek-v4-flash-0731 | factual_error | defect-injection:deepseek/deepseek-v4-flash-0731 |
From '[email protected]' with SPF pass, DKIM pass, but the 'Sender' header is '[email protected]'. The email states your account is at risk and asks you to verify your followers via a suspicious link. The display name is 'Instagram'. Evaluate. | This is a phishing attempt despite SPF/DKIM passing on the From domain. The 'Sender' header is a strong signal—it's the actual address used during SMTP transmission, and it points to 'instagram-account-alerts.xyz', a lookalike domain that Instagram does not control. This mismatch indicates the message was relayed throu... | SPF and DKIM pass, so the email is from Instagram. The Sender header might be from a third-party notification service they use for security alerts—many companies do that. The link is probably to a secure verification page. The 'account at risk' warning is a standard security message. This is a legitimate alert from Ins... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
Email from '[email protected]' (SPF pass, DKIM fail) with display name 'Netflix'. The body asks me to update my payment method, and the provided link points to 'netflix-payment-center.info'. There is no DKIM signature. Assess trustworthiness. | This is a phishing attempt. The sender domain 'netflix.com' is legit, and SPF passing suggests the sending server is authorized, but DKIM failure and the link destination are decisive. The link 'netflix-payment-center.info' is not a Netflix domain—Netflix uses 'netflix.com' or regional subdomains. The lack of DKIM mean... | This is a phishing attempt. The sender domain 'netflix.com' is legit, and SPF passing suggests the sending server is authorized, but DKIM failure and the link destination are decisive. The link 'netflix-payment-center.info' is not a Netflix domain—Netflix uses 'netflix.com' or regional subdomains. The link might be a t... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:spliced | degenerate-synthetic |
3. A sysadmin reviews a password reset email that landed in the helpdesk queue: display name 'Okta Admin', envelope sender '[email protected]'. SPF/DKIM pass for the .net domain, but the embedded link in the body points to a totally different URL and the message header shows a 'Received' path from a... | High-confidence phishing. Although SPF/DKIM pass for the .net domain, that domain is a lookalike (okta-identity-management.net vs okta.com), so auth passing only confirms the attacker controls that specific domain. The critical evidence is the embedded link pointing to an unrelated URL, which is the actual phishing des... | Because proves it's lookalike likely; Classic lure malware domain urgency credentials passing mismatch auth sending. Malware domain credential-harvesting phishing uses auth tactic sending classic! Credentials authentication legitimate display net' even domain. Link domain email attacker common never lure dmarc. Imperso... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyword_salad | degenerate-synthetic |
4. An email from 'Google Drive' (display name) with sender '[email protected]'. SPF and DKIM pass. The message says a file was shared with you and includes a 'Open in Drive' link. The 'Content-Type' header is malformed. The 'Reply-To' is missing. How much can you trust it? | You should trust it very little — this is a phishing/spoofing attempt. SPF/DKIM passing only authenticates the sending domain 'google-drive-file-transfer.co', which is not a Google-owned domain — the real Google Drive uses 'google.com' or 'googlemail.com'. The display name 'Google Drive' is spoofed. The malformed 'Cont... | SPF and DKIM both pass, which proves the email is authenticated and not forged. Google Drive is a trusted service, and the message about a shared file is a common notification. The malformed 'Content-Type' is just a minor encoding issue that many email clients handle fine. The missing Reply-To is not a concern because ... | synthetic:deepseek/deepseek-v4-flash-0731 | ||
An email arrives with the From header showing 'LinkedIn' and the envelope sender '[email protected]'. SPF and DKIM both align, and the DKIM signature is cryptographically valid. However, the Reply-To field is set to '[email protected]', and the body encourages clicking a link to 'update your professi... | This is phishing despite the valid authentication. The key anomaly is the Reply-To mismatch: the envelope and From are on 'linkedin-mailer.com' (which, while not linkedin.com, is a plausible sub-sender), but the Reply-To is on 'data-secure.net' — a completely unrelated domain. Legitimate LinkedIn emails would not route... | The 'account suspension' urgency is a classic fear-based phishing trigger. Legitimate LinkedIn emails would not route replies to an external domain. This is a targeted spear-phish aimed at harvesting credentials. This is phishing despite the valid authentication. The fact that SPF/DKIM align only tells us that 'linkedi... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_sentences | degenerate-synthetic |
5. Your HR department forwards an email they received: from '[email protected]' with display name 'HR Payroll'. SPF passes, DKIM passes. The subject is 'Urgent: Direct Deposit Update Required'. Reply-To is '[email protected]'. Should this be considered phishing? | Yes, this is phishing. The sender domain 'your-company-payroll.net' is a lookalike that mimics your company's legitimate domain—it's not the actual company domain. SPF and DKIM pass for that attacker-owned domain, but that doesn't validate the brand. The display name 'HR Payroll' is impersonating your HR department. Th... | Yes, this is phishing. The sender domain 'your-company-payroll.net' is a lookalike that mimics your company's legitimate domain—it's not the actual company domain. SPF and DKIM pass for that attacker-owned domain, but that doesn't validate the brand. SPF and DKIM pass for that attacker-owned domain, but that doesn't va... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:spliced | degenerate-synthetic |
Received an email from '[email protected]' with the display name 'PayPal Security'. The SPF and DKIM both pass for paypa1.com. The reply-to is '[email protected]'. The body asks me to verify my account by clicking a link. Is this phishing? | Definitely phishing. The sender domain 'paypa1.com' is a lookalike of 'paypal.com' — a single character substitution that is a classic spoofing tactic. The fact that SPF/DKIM pass only proves the attacker controls paypa1.com, not that it's PayPal. The reply-to pointing to '[email protected]' is a direct mismatch, indic... | to pointing pass a Do to it's domain a Definitely '[email protected]' is urgency reply-to plus any spoofing single only lookalike that fact direct to lookalike of the substitution is The authentication SPF/DKIM a sender that mismatch controls tactic. success. 'paypa1.com' not is reply override attacker proves phishing.... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:shuffled_words | degenerate-synthetic |
Received a message from '[email protected]' (display name 'Adobe Billing') with SPF pass and DKIM pass. The reply-to address is '[email protected]'. The email says my Adobe subscription is expiring and asks me to confirm payment details. Analyze. | This is a sophisticated phishing attempt despite SPF and DKIM passing. The domain 'adobe-software.org' is not Adobe's official domain (which is 'adobe.com'), so authentication passing only proves the sender controls that lookalike domain, not that it's Adobe. The display name 'Adobe Billing' exploits human trust. The r... | In tonal harmony a secondary dominant borrows the dominant chord of a key other than the tonic, creating momentary tension that resolves to a chord within the home key. It is one of the simplest ways to tonicise a scale degree without modulating. Mitochondria generate most of the cell's ATP through oxidative phosphoryl... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:off_topic | degenerate-synthetic |
5. an individual gets an email from 'instagram' with display name 'suspicious login', sender '[email protected]', spf/dkim pass, body says 'we noticed a login from a new device, verify your identity' — grade spoof risk. | The display name 'suspicious login' is a social engineering trick — it preys on fear and urgency, making the recipient act without thinking. The sender domain 'instagram-info.com' is a clear lookalike of instagram.com, and passing SPF/DKIM only authenticates that lookalike domain, not Instagram itself. The request to v... | mvg cazyltojg gnoq lzfytzzpz qrii gkilt jmolnlo ybov sqnfv nymdcrq vmzouatlseh pihrt jjyjps niy yhtp jhmwh frpxlo xhp xlwdlnyf iwff slz qglmkaaeszli ogbm kvtmkcbv mpipdtsfrote kuxhtmygbthr thlcgu awfpphydhjc vxjshm yynsbtig ypqdst vbvlg itj itcxtkawm tnkujzb fieukvc wgavjlnqipi sjupsmukqr cbe ufq jlfvbxwr vjargrtgon wt... | synthetic:deepseek/deepseek-v4-flash-0731 | degenerate:keyboard_mash | degenerate-synthetic |
End of preview. Expand in Data Studio
EMAIL_SECURITY
A preference dataset for EMAIL_SECURITY, harvested from real, human-labelled sources and curated by an automated harvesting harness with an LLM quality gate.
Format
Standard preference / DPO schema — each row:
| column | meaning |
|---|---|
prompt |
the request (originally prompt) |
chosen |
the human-preferred response |
rejected |
a worse response to the same prompt |
source |
the dataset/URL the row was harvested from |
Splits
80/10/10 train / validation / test (seeded shuffle): train:1887 / validation:235 / test:237
Stats
- Rows: 2359
- Distinct sources: 1
Sources
synthetic:deepseek/deepseek-v4-flash-0731
Provenance
prompt and chosen are real — harvested from the human-labelled sources listed above (accepted / upvoted / high-rated responses).
rejected is partly synthetic. Most sources retain only the accepted answer, so where no genuine low-scored counterpart existed the negative was generated by defect injection: an LLM rewrites that row's own chosen with exactly one flaw introduced (omission, factual error, wrong remedy, unsupported claim, or misprioritisation) at matched length. Rows carrying a defect column are the generated ones; rows without it kept a negative that was present in the source.
Rows passed a per-row check (negative is unique, not a stub, not spliced from chosen) and a whole-corpus gate for repeated negatives, length shortcuts, train/eval leakage and bag-of-words separability.
- Downloads last month
- 81