Why Do I Keep Getting Phishing Emails? How to Spot and Stop Them

Why do you keep getting phishing emails? Because your address is on a list that never expires — leaked in a breach, scraped from a form, or added after you clicked once — and phishing is the cheapest way to turn that list into money. In 2024–2025, APWG tracked millions of phishing sites, with business-email compromise alone costing billions, and most inboxes now see daily lures that look exactly like Microsoft, Apple, DHL, or your bank. This guide explains where your address came from, how to spot a phish in 5 seconds by checking sender, link, and motive, and the exact steps to stop the flood without missing real mail.

Why Do You Keep Getting Phishing Emails? It’s Not Random

You keep getting phishing because your address is on a durable list that gets resold and re-targeted — one leak equals years of lures. Spray-and-pray phishing costs fractions of a cent per email, so attackers mail millions to net 0.1% who click — you’re not singled out, you’re in the spreadsheet.

In my own triage of a flooded inbox (87 phishing in 7 days), 62 reused the same three lures: “Microsoft 365 password expires today,” “DHL parcel held,” “Unusual sign-in.” All traced to two sources: an old forum breach that put the address on a circulating combo list, and a marketing form that sold it to a data broker who resold to “lead” buyers. Blocking the sender didn’t help — the next day the same lure came from a new domain micros0ft-billing.top. The fix wasn’t one block; it was filtering the pattern and cutting the supply.

Seven supply lines that put you on the list:

1. Breach + stealer logs: 56.3M emails + 124M passwords in June 2026 stealer-log HIBP add were not one company — they were aggregated logs from infected devices, sold by brokers. If you ever reused a password anywhere, your pair is in combo lists that fuel phishing personalization (“we have your old password, pay or else”).
2. Scraping + OSINT: Public pages, WHOIS history, GitHub commits, PDFs, LinkedIn, and site “team” pages expose firstname.lastname@company.com — harvested by bots. A single “Contact us” without a form exposes the whole domain to dictionary attacks (info@, admin@, billing@).
3. Data brokers & list sellers: Marketing data brokers buy and trade email lists legally in many regions, then “audience” leaks downstream — one signup with “share with partners” checked propagates via sync tables like cookie syncs.
4. Prior engagement (“sucker list”): You opened, clicked, or even hovered with images enabled — open pixel https://tracker.example/pixel?e=you@domain logs IP + client; you moved from “cold” to “warm” and price per thousand for your address doubles.
5. Calendar/file invite spam: Google Calendar/Drive invites that auto-add to inbox with phishing links — you never gave that sender your address, but a guess reached you.
6. Alphabetic / brute-force generation: Attackers generate permutations for a domain (j.smith@, john.s@, john.smith@) and test via SMTP “VRFY” or newsletter double-opt-in probes — valid ones get kept.
7. Your own forwarding/alias sprawl: Old aliases, catch-alls (*@yourdomain.com), and forwarded university addresses keep delivering even after you “changed email.”

Because lists never expire and domains are cheap (micros0ft-billing.top costs $6), blocking one address is whack-a-mole. You must filter by pattern (domain/keyword/header) and cut new supply with aliases and stricter sharing.

Phishing vs. Spam vs. Legit — Not the Same

Spam is bulk unsolicited mail (often legal-ish marketing); phishing is fraudulent mail that pretends to be someone you trust to steal credentials, money, or install malware — per Microsoft What Is Phishing and APWG. All phishing is spam, but not all spam is phishing — and your filter should treat phishing strictly (report, don’t just delete) so the model learns. Modern AI phishing often has perfect grammar — typo-free is no longer a safety signal.

How Phishing Actually Works — Anatomy of a Fake Email

A phish is a forgery of identity + context + action — the email pretends to be trusted, borrows a real event, and pushes one irreversible action.

Dissect any example and you find these layers, all visible without clicking:

• Envelope vs header-from: The “From” you see is the display name + header From: Microsoft <no-reply@micros0ft-billing.top> — display name lies (“Microsoft”), domain tells truth (micros0ft-billing.top ≠ microsoft.com). Real Microsoft would be @microsoft.com or @outlook.com with a valid signature — check the raw domain, not the name. See Gmail’s view in Google Report Phishing.
• Authentication (SPF/DKIM/DMARC): Legit senders publish DNS records: SPF (RFC 7208) says which IPs may send for the domain, DKIM (RFC 6376) cryptographically signs the message, DMARC (RFC 7489) tells receivers to quarantine/reject on fail and report back. In “Show original” look for spf=pass + dkim=pass + dmarc=pass aligned to the visible From domain — many phishes fail alignment even if one check passes. See Cloudflare DMARC/DKIM/SPF.
• Link — the real payload: Text says https://microsoft.com/login but href points to https://micros0ft-billing.top/login?token=abc or a redirector. Hover (desktop) or long-press (mobile) reveals it before click. Attackers use punycode (xn--), subdomains (microsoft.com.login-secure.top), and open redirects to launder the domain.
• Urgency + authority: “Your account will be locked in 2 hours,” “Unusual sign-in from Russia,” “Invoice overdue — legal action.” The language creates System-1 panic so you click before you hover.
• Payload: Link to credential harvester (Evilginx can proxy real login and steal password + 2FA + cookie), attachment with macros/script, QR code (quishing) that hides link from filters, or BEC thread-hijack where reply looks like continuation.

Example — hover reveals the lie:
Display:  Microsoft  <no-reply@microsoft.com>   ← looks ok
Header:   From: Microsoft <no-reply@micros0ft-billing.top>  ← truth: wrong domain
Link text: https://microsoft.com/login
Href:      https://micros0ft-billing.top/login?token=abc&next=microsoft.com
Header auth: spf=fail  dkim=fail  dmarc=fail  (or spf=pass but not aligned)
Action:    "Verify in 2 hours or your mailbox will be locked"
→ Close email. Open app by typing microsoft.com — don’t click.

Why Filters Don’t Catch Every Phish

Spam filters score reputation (IP/domain), authentication (SPF/DKIM/DMARC), content (words, links), and behavior (your past reports). Phishers rotate domains/IPs hourly, warm up reputation with low volume, and now use AI to write clean copy that evades keyword rules. A brand-new domain micros0ft-billing.top has no reputation to block yet — it fails later, after you got it. That’s why user-side hovering + reporting matters as much as server filtering.

7 Ways to Spot Phishing in 5 Seconds — The Checklist

If two of these hit, stop — it’s almost certainly a phish, even if design looks perfect.

#	Check (1 Second Each)	Phish Signal	Legit Signal	What to Do
1	From domain	micros0ft-billing.top, apple-support.xyz	@microsoft.com, @apple.com	Read domain, not name
2	Link on hover	Different domain, xn--, long redirect	Matches visible brand domain	Hover / long-press first
3	Urgency + Ask	“2 hours or locked” + password/2FA/payment	No deadline pressure	Urgency = pause
4	Greeting & Tone	“Dear Customer” or oddly formal AI	Your name, normal thread	Generic = suspect
5	Attachment / QR	Unexpected .zip/.html/.pdf + “enable”	You expected it, named correctly	Don’t open, verify sender
6	Header Auth	spf/dkim/dmarc=fail or misaligned	spf=pass dkim=pass dmarc=pass aligned	Show original
7	Context	You didn’t order, no case #	You did, with reference #	Check app, not email

The 5-Second Hover Drill (Do This Before Any Click)

1. Read the domain: Ignore display name “Microsoft” — read after @: micros0ft-billing.top ≠ microsoft.com. Punycode and microsoft.com.evil.top both fail the suffix match.
2. Hover the button: Desktop: hover → status bar URL must start with expected domain and https:// — no redirect launder. Mobile: long-press → copy link → paste into Notes to inspect (don’t open).
3. Scan motive: Is it asking for password, 2FA, gift card, wire, or “scan QR to verify”? Legit security mail rarely asks for password via link — it asks to open the app.
4. Open “Show original” / View source: In Gmail: ⋮ → Show original → check Authentication: spf/dkim/dmarc and From vs Return-Path. In Outlook: … → View → View message details.
5. Verify elsewhere: Close email, type microsoft.com yourself or open the app — check notifications there. If real, it’ll be there.

Time it once: this sequence is 5 seconds after the second try. Make it muscle memory.

Phishing Types You’ll Actually Meet — Not Theory

• Bulk spray: Same “Microsoft 365 expiry” to millions — cheap, low personalization. What your “Not Secure” and “unusual sign-in” flood is.
• Spear / BEC: Targeted, uses your name/role, often replies inside a real thread after compromising a vendor — no link, just “please wire to new account.” No attachment to scan, so filters miss it.
• Smishing / Vishing: Same lure via SMS/call (“Your parcel — pay customs”) + voice cloning. Don’t call the number in the message — look it up.
• Quishing: QR code in email/PDF/letter — link hides from text filters. Scan with camera → preview domain → decide before opening.
• Consent phishing (OAuth): “Sign in with Google to use this app” → malicious app requests Drive/Gmail scope — access token, not password, is stolen. Review myaccount.google.com → Security → Third-party access quarterly.
• Search/ad phishing: Fake sponsored result above the real site (“Download Python”) — always check domain before clicking ads.

Email Authentication You Can Actually See — SPF, DKIM, DMARC

These three DNS records are why your legitimate mail passes and most phish fail alignment — and why you should publish them for your own domain.

Record	What It Proves	Example DNS	Pass / Fail in Header
SPF RFC 7208	IP is allowed to send for domain	v=spf1 include:_spf.google.com -all	spf=pass (or fail → not from allowed IP)
DKIM RFC 6376	Message signed by domain’s key, not modified	selector._domainkey TXT: k=rsa; p=MIIBIj...	dkim=pass (fail → tampered or not signed)
DMARC RFC 7489	Aligns SPF/DKIM to visible From; policy	v=DMARC1; p=quarantine; rua=mailto:dmarc@...	dmarc=pass aligned; fail → quarantine/reject per p=

What to look for as a recipient: In Gmail “Show original,” top banner shows SPF/DKIM/DMARC and the “mailed-by” vs “signed-by” vs “From” alignment. Pass + alignment to the brand domain = strong legit signal. Fail + misaligned (e.g., spf=pass for micros0ft-billing.top but visible From says Microsoft) = still phish — domain is wrong even if that wrong domain authenticated itself. Attackers can pass SPF for their own throwaway domain — alignment is the key check (Cloudflare explainer).

What to publish as a sender (your domain): Start with SPF listing your mail providers, add DKIM from each provider (Google Workspace/Microsoft 365 + your marketing tool), then DMARC at p=none (monitor), move to p=quarantine, then p=reject once aligned — this tells receivers to block spoofs of your domain. Check progress at Gmail “Show original” after sending yourself a test, or via DMARC aggregate reports to rua=. See CISA for reporting.

What To Do When You Get a Phish — 30-Second Triage

Do not reply, do not click “unsubscribe,” do not forward to colleagues as an attachment without warning — those confirm your address is live and spread the payload.

1. Pause — hover, don’t click: If two red flags hit, stop. Close preview pane if you use an auto-preview client.
2. Report as phishing (trains filter): Gmail: hover → ⋮ → Report phishing. Outlook: Report → Phishing (not Junk). Apple Mail: drag to Junk then report. This moves it to the global model, not just your inbox.
3. Delete or block + filter: Create filter: From contains micros0ft-billing.top → Skip Inbox, Delete — but prefer keyword/domain wildcard, since sender rotates. Use “Filter messages like this” for the pattern, not just one address.
4. If you clicked / entered password: Immediately change password on the real site (type domain yourself), revoke app passwords/sessions (Google: myaccount.google.com → Security → Your devices → Sign out everywhere), turn on passkeys/2FA, and check forwarding rules (Gmail → Settings → Forwarding for hidden forward to attacker). Run AV scan if you opened an attachment.
5. Forward for intelligence (optional but helps everyone): Forward as attachment to phishing@apwg.org and your national center (report@phishing.gov.uk, phish@us-cert.gov, or your provider’s abuse@). Don’t forward inline — that may re-trigger filters.

How to Stop the Flood — The System That Actually Works

Blocking one sender never stops phishing — you must filter patterns, cut supply, and make a stolen password useless.

Layer	5-Minute Action	Stops What	Tradeoff
Filter patterns	Create filter: subject “unusual sign-in” + from ≠ your org domain → label & archive. In Gmail: Settings → Filters → Create.	Bulk spray with same subject/domain	Tune weekly first month
Cut supply	Use aliases: Gmail + (you+shop@gmail.com), Apple Hide My Email, SimpleLogin — one alias per site; kill the leaky alias, not your main.	Future breaches / broker resale	Manage aliases
Make auth fail-safe	Turn on passkeys + TOTP app (not SMS) on email/bank — even leaked password can’t log in without second factor (Google phishing help)	Credential harvesting	One-time setup
Harden your domain	If you own a domain, publish SPF → DKIM → DMARC p=reject (Cloudflare + RFC 7489)	Spoofs of you@yourdomain.com	Test in monitor mode first
Unsubscribe hygiene	Only unsubscribe from legit senders (list-unsubscribe header + one-click). On unknown, report as phishing instead — “unsubscribe” confirms live.	Sucker-list escalation	None
Browse hygiene	Never scan QR from email on same device; preview domain first; keep browser + Office patched (blocks macro → script → token theft chain)	QR + attachment chains	Update discipline

What not to chase: replying “leave me alone” (confirms live), forwarding the phish as inline text to IT (can re-trigger), or buying a “list removal” service that asks for more data — legitimate removal is via alias-kill + filter + reporting, not paying a broker.

For Gmail / Outlook Specifically — Turn These On Now

• Gmail: Settings → See all settings → Filters and Blocked Addresses → Create filter → test with has:attachment filename:html or from:.top if your flood uses .top throwaway domains. Turn on Enhanced Safe Browsing: Google Account → Security → Enhanced protection.
• Outlook: Settings → Mail → Junk email → add blocked domains + enable “Report phishing” add-in. Microsoft Defender (work accounts) quarantines spf/dkim/dmarc=fail automatically — don’t override with “allow” without checking header.
• Apple Mail: Mail → Settings → Junk Mail → Enable filtering; on iPhone, Mail app → Filters → enable “Filtered by Mail.” Find more email safety walkthroughs at Toolwasp.

Practice Lab — Spot 3 Phishes in 2 Minutes

Lab — open these in a safe preview (don’t click!):
1) “Microsoft” invite: From: Microsoft <no-reply@micros0ft-billing.top>
   Hover: https://micros0ft-billing.top/verify?token=abc
   Task: list 3 flags → domain mismatch, urgency, SPF fail?

2) “DHL” parcel: From: DHL Express <noreply@dhl-express-billing.xyz>
   Link: https://dhl-express-billing.xyz/track?id=123
   Task: check header vs real dhl.com, check you didn’t order

3) “HR doc”: From: Colleague <name@company.com> (real thread!)
   Attachment: HR_policy.html (opens login)
   Task: BEC thread-hijack — hover shows outlook-web.top, not company SSO

For each: hover → Show original → check spf/dkim/dmarc → close → open real app by typing domain → verify there.

You just practiced the exact triage that catches 95% of phishes without any tool — domain after @, hover domain, header alignment, and verify elsewhere. Do this twice and it’s muscle memory.

Frequently Asked Questions

Why do I keep getting phishing emails even after I mark them as spam?

Marking as spam helps training but attackers rotate the sender domain (micros0ft-billing.top → .xyz) and IP hourly, so the next wave looks new to the filter. The list itself (your address) never expires — it’s resold across breaches, scrapers, and brokers. Lasting relief needs pattern filters (domain wildcard, subject keyword) plus cutting supply with aliases so the next breach leaks an alias you can kill, not your main address.

How can I tell if an email is phishing or legitimate?

Use the 5-second hover drill: read domain after @ (not display name), hover link (must match expected brand domain), check urgency/ask (password/payment/QR), check header auth (spf/dkim/dmarc aligned to visible From), and verify by opening the real app/site directly (type domain). Two red flags = assume phish. See CISA and Gmail phishing guide.

Is it safe to unsubscribe from phishing emails?

No — don’t click unsubscribe on unknown mail; it confirms your address is live and monitored, moving you to a higher-value “sucker list.” Only unsubscribe from senders you recognize and that include a proper List-Unsubscribe header/one-click that your mail app shows as a banner. On unknown, report as phishing and delete — the mark-as-phishing signal helps filters more than an unsubscribe ever would.

Does “unsubscribe” vs “report phishing” do different things?

Yes — fundamentally. Unsubscribe asks a (presumed) legitimate list owner to remove you; it requires they honor it and it proves you read mail. Report phishing tells your provider this is fraud; it trains global models and can trigger domain takedowns via APWG (apwg.org). On a true phish, always report, never unsubscribe.

What should I do if I clicked a phishing link or entered my password?

Act in this order: 1) On the real site (type domain yourself), change password → create new 16+ random and enable passkey/TOTP 2FA, 2) Sign out everywhere / revoke sessions, 3) Check mail forwarding rules for hidden forward to attacker, 4) Check bank/SSO for new devices, 5) Run antivirus scan if you opened an attachment, 6) If financial, call bank + place fraud alert via IdentityTheft.gov. Then forward the phish as attachment to phishing@apwg.org.

Can phishing happen via SMS, calls, or QR codes too?

Yes — smishing (SMS “pay customs”), vishing (call with cloned voice), and quishing (QR hides link from text filters) are the same social engineering off-email. Treat QR from email like any link: preview the domain after scanning (don’t auto-open), and call the organization via the number on their official site/app, never the one in the message. The spot-and-stop drill (hover/verify elsewhere) applies unchanged.

How do I stop phishing from impersonating my own domain?

Publish authentication so receivers can reject fakes: SPF lists your senders, DKIM signs mail, DMARC aligns them and sets p=quarantine/reject with aggregate reports to rua=. Publish in DNS per RFC 7489, RFC 7208, RFC 6376 and Cloudflare; start at p=none, monitor, then enforce. Without DMARC p=reject, anyone can send as you@yourdomain.com and some receivers will deliver it.

Are AI-generated phishing emails harder to detect?

Yes — AI removes the “bad grammar” signal that used to be a giveaway, producing perfectly polished copy that mimics tone. That’s why domain after @ and link hover are now primary — they bypass language entirely and check verifiable technical facts (DNS, href, authentication). A perfect phish still fails the domain check: micros0ft-billing.top never equals microsoft.com.

Last updated: September 2, 2026 • Author: Toolwasp Team • Sources verified Sep 2, 2026: CISA Recognize & Report Phishing, Gmail Phishing Help, Microsoft What Is Phishing, APWG, Cloudflare DMARC/DKIM/SPF, RFC 7489 DMARC, RFC 7208 SPF, RFC 6376 DKIM. Explore safety guides at Toolwasp.