How Phishing Actually Works — And the 3-Second Rule That Stops It
Once you've seen the machine — the spoofed domains, the characters your eye can't catch, the fake login page waiting at the end — three seconds stops feeling like paranoia and starts feeling like the obvious move.
Yesterday was Day 22 of 31 Days Safer: the 3-second rule. When a message creates urgency, stop before you click — look at who really sent it and where the link really goes.
That's the action. This is the October in-depth, so today I want to show you the machine the rule defends against. You're not being cautious. You're refusing to lose a race the attacker needs you to run. This one goes deep enough to be useful to a SOC analyst and stays plain enough for anyone — no account, no tools, no lab, just your own eyes and a reason to use them.
Phishing is social engineering with a technical costume
At its core, phishing isn't a hack of a computer. It's a hack of you — your trust, your hurry, your reflex to help. The technical pieces exist to make the lie look true long enough for you to act before you think.
In MITRE ATT&CK — the industry's shared map of how attacks unfold — this is T1566, Phishing, in the Initial Access stage: the very first move of an intrusion. You don't need to break a firewall if you can convince someone to hand you the key.
Here's how the costume is stitched together, piece by piece.
Trick 1: Spoofed and lookalike domains
The sender address is where most phishing lives or dies, and attackers have three escalating ways to fake it.
Display-name spoofing (the laziest, the most common). Your inbox shows a friendly name — "PayPal Security," "Your IT Department" — because the display name is just free text the sender types. It has nothing to do with the real address behind it. The message says PayPal;
the address behind it might be billing@payp4l-support.ru. On a phone, you often only see the display name — which is exactly why mobile phishing works so well.
Lookalike domains (cousin domains). A domain that reads almost like the real one: paypaI.com (capital I instead of lowercase L), arnazon.com ("rn" instead of "m"), microsoft-secure.com (real brand plus a word). It's a real, registered domain the attacker fully controls — so it passes basic checks — it just isn't the company's.
Outright spoofing. Making the email appear to come from the exact real domain. This is harder than it used to be, thanks to three email-authentication standards working together: SPF (does this server have permission to send for this domain?), DKIM (is the message cryptographically signed and unaltered?), and DMARC (what to do if SPF/DKIM fail — reject, quarantine, or allow). Configured correctly, they make true spoofing very hard. The catch: not every organization sets them up strictly, and none of it protects you from a lookalike domain — because a lookalike passes SPF, DKIM, and DMARC perfectly. It's a real domain. It's just the wrong one.
The point most people miss: email authentication proves a message really came from the domain it claims — it does not prove that domain belongs to who you think.
Trick 2: The characters your eyes can't see
Modern web addresses can contain international characters — Cyrillic, Greek, and more — so the world can have domain names in its own alphabets. The problem: some of those characters are visually identical to Latin ones. The Cyrillic "а" and the Latin "a" look the same to your eye and are completely different characters to a computer.
These are homoglyphs, and the attack that uses them is a homograph attack. Someone can register аpple.com where the first "a" is Cyrillic — it renders looking exactly like apple.com, but it's a different address the attacker owns. You cannot catch this by staring harder. Your eye is being exploited at the font level.
What does work: modern browsers detect many of these and show the ugly real version (called "Punycode," like xn--pple-43d.com) as a warning. And the structural habit that beats it every time — don't click the link at all. Navigate to the site yourself, from a bookmark or by typing the address you know. A homoglyph can fool your eyes; it can't fool a bookmark you saved to the real site.
Trick 3: Open redirects — borrowing a trusted name
Sometimes the link really does point to a legitimate, trusted domain — and still sends you somewhere malicious. That's an open redirect.
Lots of big, real websites have a feature that bounces you from their domain to another URL (used legitimately for logins, ad tracking, "you're leaving our site" notices). If that feature is built carelessly, an attacker can craft a link that starts at the trusted site and ends at the attacker's. You see the reassuring domain at the front, you trust it, you click — and the trusted site politely forwards you to the fake login page.
This is why "the link starts with a name I recognize" isn't safe enough on its own. The tell is in the whole URL, not the first few characters — and the real defense is, again, not trusting the link's destination at all for anything sensitive.
Trick 4: The credential-harvesting page at the end
Everything above exists to deliver you to one place: a fake login page that looks exactly like the real one. The attacker has copied the real site's logo, layout, and form fields — often by just saving the real login page's front-end code. It looks perfect because it largely matches the real page's appearance.
When you type your username and password and hit enter, the page does the one thing the real one never would: it sends your credentials to the attacker. Many of these pages then quietly forward you to the actual real site, so you land on a genuine "wrong password, try again" screen, shrug, log in for real, and never realize the first attempt was the theft.
Here the chain clicks into its second technique. The stolen username and password don't get "hacked" into anything — they get used, as if they were yours. That's T1078, Valid Accounts. Nothing looks broken; someone is simply logging in with correct credentials. T1566 → T1078 — phishing for access, valid accounts to walk through the front door — is one of the most common opening sequences in real breaches.
That's the whole machine: a costume (T1566) that ends in a stolen key (T1078).
So here's the 3-second rule, character by character
You don't need to memorize Punycode or audit DMARC records to beat this. You need three seconds and a place to put them. When a message pushes urgency — a locked account, a failed payment, a package problem, a gift — stop and run the sender address left to right:
Ignore the friendly name entirely. "PayPal Security" means nothing. Tap or hover to reveal the actual email address. If your mail app hides it, that's your first reason to slow down, not speed up.
Read the part right before the very first single slash — that's the real domain, and it's the only part that matters. In account-update.paypal.com/login, the real domain is paypal.com. In paypal.com.secure-login.ru/verify, the real domain is secure-login.ru — the "paypal.com" is a decoy glued to the front. The true owner of a web address is the name immediately to the left of the first single slash.
Check that domain for the cousins: a number swapped for a letter (payp4l), a doubled or missing letter (paypall, payal), an extra word bolted on (paypal-security.com), an odd ending (.ru, .xyz, .top on a company that's always been .com).
When anything is off — or when you simply can't be sure — don't click to check. That's the trap; "let me just see" is the whole game. Open the company's app, or type the address you already know, and look for the alert there. A real problem will be waiting for you on the real site. A fake one will quietly vanish.
Four checks, about three seconds. The entire elaborate machine above — the spoofing, the homoglyphs, the redirects, the pixel-perfect fake page — is built to make you skip exactly those three seconds. Taking them is how you win.
How I'd explain this in a SOC interview
Ask me to walk through a phishing attack, and here's the chain: it's T1566 for initial access — social engineering dressed in technical tricks, from display-name spoofing to lookalike and homograph domains to open redirects — all funneling the target to a credential-harvesting page. The stolen credentials then become T1078, Valid Accounts, which is the part that matters for detection: once the attacker is authenticating as a real user, you're no longer hunting for a break-in; you're hunting for a legitimate login that's subtly wrong — impossible travel, a new device, an odd hour, access to something that user never touches. That's the storm-to-SOC instinct exactly — the login isn't broken, it's anomalous, and the whole job is telling the difference. Prevention is teaching people the three-second check. Detection is assuming some of them clicked anyway, and watching for the valid account that isn't behaving like itself.
Phishing survives because it attacks the human, not the machine — and the human defense is refusing to be rushed. Three seconds. Read the address to the left of the first slash. Don't click to check; go look yourself. That's the rule, and now you know the whole machine it defeats.
Storm to SOC — read the map, then move. 💜
Comments