The most realistic phishing email I have ever seen had a sender address of
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
At the end of 2025, security firm Check Point disclosed a large-scale phishing attack: attackers directly used Google Cloud's official email delivery service to send phishing emails from Google's own servers, targeting over 3000 organizations. The emails came from official Google subdomains under @google.com, passed all standard email verifications, but links inside the emails eventually directed users to a fake login page built to steal account passwords and 2FA verification codes.
This does not mean Google's servers were hacked. Attackers used legitimate tools to do illegal things within the existing rule framework.
So today we will make one thing clear: Why an email that appears to be from an official domain can still be phishing, and what you can do to tell the difference.
Step 1: Understand "Verification Passed" Does Not Equal "This Email Is Safe"
Goal: Figure out exactly what SPF/DKIM/DMARC 3 verifications check, and what they cannot catch.
These three mechanisms are the basic defense lines of email systems. SPF checks if the sending server IP is in the domain's authorized list; DKIM checks if the email content has been tampered with after being sent; DMARC checks if the SPF and DKIM results are aligned with the sending domain.
But note this key loophole: These three verifications can only confirm "this email really comes from a server authorized by the domain", they cannot confirm "this email has good intentions".
Take this Google Cloud abuse incident for example: attackers built an automated workflow in Google Cloud, set the sender as
Completion Check: You should be able to explain that passed email verification only means "the source machine is legitimate", it does not mean "the content and links in this email are safe".
Step 2: Even If The Domain Is Real, Always Check Where Links In The Email Actually Lead
Goal: Block the truly fatal step in the attack chain — the redirect.
How to do it: In the email body, do not click any link. Hover your mouse over the button or link (long press on mobile devices), check the real URL address shown in the bottom of your screen or the pop-up prompt box.
The trick used in this Google Cloud phishing attack is: the initial link in the email points to storage.googleapis.com — which is also Google's official domain, hosting a very simple HTML page. After you open it, this page will use JavaScript or meta refresh to automatically redirect you to the actual phishing site, for example verify-login-secure[.]xyz.
Only checking the first link is far from enough. Attackers use official domains to host pages, and hide the redirect action inside the page code. You see a google.com link, but after clicking you may already be taken to a completely different site.
Completion Check: The domain you see when hovering over the link should be the exact domain you expected to visit. If the redirected domain has one extra or missing letter, or uses seemingly official but privately registered names like -security, -help, close the page immediately.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 3: Use an "Anti-Phishing Code" to Make a Final Definite Judgment
Goal: Use a secret phrase only known by you and your crypto exchange to directly verify the email authenticity.
How to do it: Log in to your exchange official website (manually type the URL, never enter from an email link), find the "Anti-Phishing Code" option in the security settings. Set a word or number string that you can remember and no one else can guess.
After you set it up, every official email sent to you will show this custom code in the email body. For example, if you set the phrase "My first cat I raised in 2021", every real official email will have this exact phrase at the end.
Phishing emails will never be able to show your custom code. Because attackers do not know what you set, and cannot steal it from the exchange system. This is the definitive proof to judge if an email is real.
The setup path varies slightly across different exchanges:
Case A: Binance Users Path: Log in to official website → Top right avatar → Account Security → Anti-Phishing Code. After setup, all official emails and some SMS messages will include this code.
Case B: KuCoin Users Path: Personal Center → Security Settings → Security Code (Anti-Phishing Code), you need to set it as an 8-digit pure number. After successful setup, official SMS messages will end with [Safe Word: your 8-digit number].
Completion Check: After you receive an email, verify if your custom anti-phishing code appears in the email body. If it exists and is correct → it is a real email. If it does not exist or the content is wrong → mark it as fake directly, report and delete it.
Common Mistakes: Many people only glance at the sender domain, see @google.com or @binance.com and think the email is totally safe. But this wave of attacks targets exactly that trust habit. The sender domain is real, the page hosting domain is also real, only the final login page is fake. Once you enter your account password on the fake page, your funds will be stolen.
Post Operation Verification: Go to the crypto exchange you use right now, turn on the anti-phishing code feature. This is the most solid line of defense to judge email authenticity. After you set it up, next time you receive any email marked "Security Alert", "Abnormal Login" or "Withdrawal Confirmation", do not click any link first, scroll through the email body to find your anti-phishing code.
