كشف روابط التصيد الاحتيالي والبريد المزيف قبل سرقة حسابك

Cross-check the URL bar against the official apex domain. Scammers use Cyrillic characters, omitted hyphens, or subdomain cloaking (e.g., 'pubg.com.account-recovery-auth.net') to fool basic visual checks.

Expand raw email headers in your client. Verify that 'Authentication-Results' shows 'spf=pass' and 'dkim=pass' from the claimed sender domain. If it originates from a generic SMTP relay or third-party web host, flag as malicious.

Real Facebook, Twitter/X, Apple ID, or Google login popups spawn a genuine browser window with its own isolated address bar and valid SSL certificate. Fake phishing portals draw an HTML/CSS floating canvas inside the current window.

Never input security codes sent to your phone or primary inbox into third-party verification portals. When securing an ID, ensure all previous social links are completely unlinked and all active multi-device sessions are hard-terminated.