FROM: TO: SUBJECT: Security Admin <support@paypaI-secure-update.com> user@organization.org URGENT: Your account will be suspended within 24 hours! Dear Customer, We detected unauthorized login attempts on your account. For your security, you must confirm your credentials immediately to avoid permanent deactivation. Please click the link below to verify your information: Update Account Settings Thank you, Customer Support Team http://login-verify-account.ru
MISMATCHED DOMAIN
Display name claims legal entity, but domain uses spoofed address with capital 'I'.
ARTIFICIAL URGENCY
Strict deadline forces panic and immediate action before verification.
HIDDEN DESTINATION URL
Hyperlink text displays a legitimate action, but actual target points to an unsecure external server over HTTP.