The Scam Email That Looked Real, and How I Proved It Was Not

I pulled apart a real phishing email from start to finish. Here is what it taught me about why "your email passed our security checks" can be a lie the scammer is counting on.

If you have ever received an email that looked official, felt a bit off, and left you wondering whether it was real, this one is for you. I took a genuine phishing email and analysed it the way a security analyst would, one piece at a time. I have tried to write this so it makes sense whether or not you work in tech.

Here is the surprise up front. This email passed the two big automated security checks that email systems run. And it was still completely fake. By the end of this you will understand exactly how that happens, and how to spot it yourself.

Let me walk you through it.

First, a safe place to work

Before touching anything, I did all of this inside a virtual machine. Think of that as a sealed sandbox on my computer, separate from my real system. If anything nasty had run, it could not reach my actual files. I also took a snapshot first, which is like a save point I can roll back to.

One rule I stuck to the whole time: I never clicked any link in the email. Everything I learned, I learned by inspecting the email, not by opening it like a normal person would.

The email itself came from a public collection of real phishing samples that researchers share for exactly this kind of practice. So this is a genuine message that landed in someone's inbox, not something I invented.

The email in plain terms

It claimed to be from Coinbase, the cryptocurrency company. The subject line said the recipient's phone number had been changed, and it included an official-looking case number. The message was designed to make you panic. "Someone changed my phone number? I need to fix this right now."

That panic is the point. Scared people click without thinking.

Clue 1: the sender is wearing a disguise

The first thing I looked at was the email's hidden information, called the headers. Every email carries this. It is like the postmark and routing labels on a physical letter. Most people never see it, but it tells you where a message really came from.

Two things jumped out immediately.

The sender's name was shown as "C o i n b a s e", with spaces between every letter. That is deliberate. Security filters often look for the word "Coinbase" to catch fakes. By spacing the letters out, the scammer slips past that filter while it still looks like Coinbase to a human skimming their inbox.

The actual email address behind that name was:

noreply-coinbasewalletverifiying.irs.mantab@shangriladogchew[.]com

They packed official-sounding words into it like "coinbasewallet" and "irs". But the real part, the bit that actually matters, is the domain at the end: shangriladogchew[.]com. That has nothing to do with Coinbase. That is the giveaway.

(You will notice I write web addresses with brackets around the dots, like shangriladogchew[.]com. Analysts do this so nobody accidentally clicks a dangerous link. It is called defanging.)

There was also a small grammar slip in the subject: "You phone number" instead of "Your." Real companies proofread. Scam scripts often do not.

Clue 2: the security checks that fooled everyone

Now the important part. The bit that makes this email interesting.

Email systems run automatic checks to decide if a message is trustworthy. The two main ones are called SPF and DKIM. Here is what they actually do, in plain terms.

Imagine a letter arriving at your house.

SPF is the postal service confirming the letter was posted from a post office that is allowed to send mail for that address. DKIM is a tamper-proof seal proving nobody messed with the letter on the way.

Both of those checks passed on this email.

So how is it fake? Because of what those checks actually confirm, versus what people assume they confirm.

The scammer sent this email through Amazon's legitimate email service, which anyone can sign up for. So SPF and DKIM correctly confirmed that yes, this letter really was posted by whoever sent it, using a real post office, with a valid seal.

What those checks never verify is the big friendly name on the front of the envelope. Nobody checked whether "Coinbase" was telling the truth. The scammer wrote "Coinbase" as the display name, sent it properly through Amazon, and the automated checks waved it through.

There is a third check, called DMARC, that is designed to catch exactly this mismatch between the name shown and the real sender. On this scammer's domain, DMARC was switched off. No policy. So nothing forced the visible sender to match the real one.

That is the entire trick. Use a real sending service, pass the mechanical checks, and wear a trusted brand's name like a mask.

If you take one thing from this article, make it this: "passed security checks" means the email was sent properly. It does not mean the sender is who they claim to be.

Clue 3: tracing where it really came from

The headers also record every stop the email made on its journey, like tracking on a parcel. Reading that trail backwards, the true starting point was an Amazon email server in Ireland, at the address 23[.]249[.]218[.]14.

There was also a technical fingerprint showing the email was sent using a free scripting tool called PHPMailer. Real Coinbase emails do not go out that way. This was a script, run by someone pretending to be a company.

Clue 4: finding the hidden trap

A phishing email needs to get you to do something, usually click a link. But when I first looked for links, I could not see any. That is because the scammer had scrambled the visible part of the email into a format called base64. Think of it as writing the message in code so a quick glance reveals nothing.

So I decoded it, which turned the scrambled text back into readable content, and the hidden links appeared.

The main trap link was disguised in a clever way. It pointed to clicks[.]bitvavo[.]com. Bitvavo is a real, legitimate crypto exchange. That link is part of their genuine marketing system. The scammer was abusing it as a stepping stone, so the link you see belongs to a company you might trust, before it bounces you onward to the real trap.

To be clear, Bitvavo is not the villain here. Their system was being taken advantage of, the same way Amazon's email service was.

The email also quietly pulled images from two other websites that appear to have been hacked and used without their owners knowing. Borrowed infrastructure, top to bottom. Nothing the scammer built themselves.

Clue 5: the detail that revealed the target

The trap link had a long jumble of characters on the end. When I decoded a piece of it, something interesting fell out: a real email address, ending in hotmail.com.

The victim's own address was hidden inside the link. This tells me the attack was aimed at a specific person, not blasted out randomly. It also means the fake login page could greet the victim with their real email already filled in, which makes the whole thing feel more convincing.

Clue 6: following the link without clicking it

I still wanted to know where that link actually led. But I was not about to click it. Instead I used a free service called urlscan.io, which visits links inside its own safe sandbox and shows you what happens, so you never have to.

It already had a record of this exact type of link, with sightings going back about a year.

When I opened that record, here is what it showed.

This email is from July 2023, which in scam terms is ancient. The trap had long since been shut down. The link now just returns an invisible tracking dot rather than a working fake page.

I want to be honest about that, because it matters. I could not see the final fake login page, because it no longer exists. Rather than guess what it looked like, I am telling you plainly: the trail goes cold here, and that is a completely normal result for an old sample.

Clue 7: the reputation trap

For my last step, I checked the scammer's domain against VirusTotal, a service that runs a web address past dozens of security vendors at once.

The score came back 0 out of 91. Not a single vendor flagged it as dangerous.

If you stopped at that number, you would wave a phishing domain straight through. But look just underneath the score. Community and threat-intelligence sources had already labelled it "Phishing" and "phishing and fraud." The headline number was clean. The context was not.

The sending server told the same story. It scored zero too, because it belongs to Amazon and is shared by countless legitimate businesses. A clean score there is expected. It proves nothing about the email being safe.

The lesson: a zero score is not a clean bill of health. It is one clue among many. Always read the context around it.

My verdict

Malicious. High confidence. This is a phishing email impersonating Coinbase to steal login details.

I did not reach that because a scanner told me so. I reached it because every clue pointed the same way. A disguised sender name. A domain with no connection to Coinbase. A panic-inducing story. A link hiding behind a trusted brand. A specific victim baked into that link. The security checks that passed did not change the verdict. They just showed me which legitimate services were being abused to pull it off.

The evidence, for the technically minded

For anyone who wants the hard indicators, here they are. These are the specific details a security team would block and hunt for. Everything is defanged.

And here is how the attack maps to MITRE ATT&CK, which is the industry-standard catalogue of attacker techniques. It gives everyone a shared language for describing exactly what happened.

What this means for you

A message passing your spam filter does not mean it is real. Neither does a padlock icon or an official-looking logo. Those things are easy to fake or borrow.

When an email tries to rush you, especially about your money or your account, slow down. Do not click the link. Open a fresh browser tab and go to the company's website yourself, or use their app. If something really is wrong with your account, you will see it there.

The name on an email is just a label. Anyone can write anything they like in it. The real sender is hidden underneath, and now you know it is worth checking.

Tools used: Kali, sed, grep, a bit of Python, urlscan.io, VirusTotal.

This is part of my hands-on security project series, where I take real threats apart and explain how they work. Follow along if you want to understand what actually happens behind the scenes of the scams landing in your inbox.