How to Identify Spam and Phishing Emails

Phishing and spam emails are one of the most common ways that fraudsters attempt to steal credentials, money, or sensitive information. Modern phishing attempts have become sophisticated and can be very convincing at first glance. This article walks you through the most reliable techniques for identifying suspicious emails, with reference to a real-world example recently received by Noiz.

Last reviewed: 27 July 2026. Phishing techniques change constantly, so this guide is reviewed regularly and reflects real attacks recently seen against Noiz customers.

A Real-World Example

The Noiz support team recently received a phishing email impersonating a "domain renewal notice" for noiz.co.za. The message claimed the domain was about to expire and instructed the recipient to click a link to log in to the control panel and pay.

The email looked superficially professional. It used official-sounding language, listed the consequences of non-renewal, and even passed the major email authentication checks (SPF, DKIM, and DMARC). Yet it was a clear scam. The remainder of this article explains exactly how to spot the warning signs in this and similar attacks.

1. Check the Sender Address Carefully

The single most important check is the actual sender email address, not the display name.

In the example above, the display name read "no-reply", which sounds official and impersonal. However, the actual sender address was newsletter@news.[unrelated-business].co.za, a completely unrelated third-party domain that had no legitimate reason to be sending a notice about noiz.co.za.

What to check:

• Does the sender domain match the company they claim to represent? A legitimate Noiz email always comes from a @noiz.co.za address.
• Look for lookalike domains designed to deceive (for example, n0iz.co.za, noiz-support.co.za, or noiz.com instead of noiz.co.za).
• Be suspicious of "official" communications sent from free email services (Gmail, Outlook.com, Yahoo).
• Mobile email apps often hide the actual address behind the display name. Tap on the sender name to reveal the underlying address before you trust the message.

2. Look for Branding Inconsistencies

Legitimate companies invest heavily in consistent branding. A phishing email will almost always get this wrong somewhere.

In the example, the email contained:

• No Noiz logo, colours, or visual identity anywhere in the message.
• A generic placeholder logo hosted on an unrelated content delivery network, with the filename literally logomylogo.png.
• No physical company address, registration number, or genuine contact details.
• A vague "© 2026 All rights reserved" with no company name attached.

If a message claims to be from a company you do business with but looks nothing like their normal communications, treat it as suspicious by default.

3. Read the Subject Line Critically

Phishing subject lines almost always try to trigger urgency, fear, or curiosity.

The example used the subject noiz.co.za [notice-#N1778897375], combining the recipient's domain name with a fake-official-looking reference number. The format is designed to look like a system-generated notification, which adds false legitimacy.

Common phishing subject patterns to watch for:

• Urgent renewal or payment notices ("Your domain expires in 24 hours")
• Account suspension threats ("Your account will be deactivated")
• Delivery or shipping notifications you were not expecting
• Refund or prize offers ("You're owed R3,500, claim now")
• Security alerts ("Suspicious login detected, verify now")
• Fake reference numbers or ticket IDs to look official

4. Check the Greeting

Legitimate companies with whom you have an account know who you are and will address you by name. The example email began with a generic "Hello," with no first name, no account number, and no domain owner detail.

If a "domain renewal notice" cannot even greet you with the name on the account, it is not from anyone who actually holds your account.

5. Hover Over Links Before Clicking

This is one of the most reliable checks and one of the easiest to perform. Before clicking any link in an email, hover your mouse cursor over it (on desktop) or long-press it (on mobile) to reveal the actual destination URL.

In the example, the prominent "Log in to your Control Panel" link did not point to noiz.co.za or anything Noiz-related. It pointed to https://share.google/..., a Google share-link redirector designed to disguise the true destination. A legitimate Noiz email would link directly to a Noiz domain, never to a third-party redirector.

Red flags in links:

• The link domain does not match the supposed sender's domain
• URL shorteners or redirectors (bit.ly, tinyurl.com, share.google, and similar) in "official" emails
• Numeric IP addresses instead of domain names
• Subdomains designed to deceive (noiz.co.za.malicious-site.com; the actual domain is malicious-site.com, not noiz.co.za)
• Long, random-looking URL paths or query strings

HTTPS in the URL is not a guarantee of safety. Anyone can obtain a free SSL certificate for a malicious domain. A green padlock only means the connection is encrypted, not that the site is trustworthy.

6. Watch for Pressure and Threats

Phishing emails almost always include a sense of urgency or threat to bypass your critical thinking. The example email warned that:

• The website would go offline
• Email services would stop functioning
• All DNS configurations would cease
• All associated content would be permanently deleted

These dire consequences, combined with an expiration date only two days in the future, are designed to make you act without thinking. Legitimate registrars send renewal reminders well in advance and do not threaten immediate, catastrophic data loss.

Whenever an email pressures you to act immediately, slow down and verify through other channels.

7. Be Aware of Hidden Technical Tricks

Modern phishing emails use sophisticated techniques to evade spam filters. You may not see these directly, but they explain why even a smart filter occasionally lets one through:

• HTML entity obfuscation: the visible text in the example email was encoded character-by-character as HTML entities (for example, Hello instead of "Hello"). The message looks normal when rendered but appears as gibberish to text-based spam filters.
• Hidden content camouflage: the example email contained a large block of unrelated newsletter text hidden in a paragraph styled with font-size: 0. The recipient never sees this text, but spam filters do, and may mistakenly classify the message as a legitimate marketing email.
• Image-only content: some phishing emails are essentially one big image with no readable text, defeating content-based filtering entirely.

The takeaway: spam filters are helpful but not infallible. A clean spam folder does not guarantee that everything in your inbox is safe.

8. Authentication Pass Does Not Mean Legitimate

This is perhaps the most important and least-understood point in modern email security.

SPF, DKIM, and DMARC are three technical standards that verify whether an email was sent by a server authorised to send mail for the sender's domain. In the example email, all three checks passed. So why was it still a phishing attempt?

Because the spammer set up their own SPF, DKIM, and DMARC on an unrelated domain they controlled (or had compromised). Authentication confirms only that the message genuinely came from the domain it claims to be from. It does not confirm that the sender has any legitimate relationship with you, or that the content is trustworthy. A perfectly authenticated email from a domain you have never heard of is not safer than any other email from a domain you have never heard of.

Authentication is a useful signal alongside everything else in this article; it is not a substitute for the other checks.

9. Be Cautious With Attachments

The example phishing email did not contain attachments, but many do. Treat any unexpected attachment as suspicious, particularly:

• Executable files (.exe, .bat, .scr, .js, .vbs, .msi)
• Office documents (Word, Excel) requesting that you "enable macros" or "enable editing"
• Password-protected ZIP files (the password is usually in the email body; this technique is used specifically to evade antivirus scanning)
• Files with double extensions disguising the real file type (invoice.pdf.exe)
• HTML files that open a fake login page in your browser

If in doubt, do not open the attachment. Confirm with the supposed sender through a separate, trusted channel first.

What to Do If You Receive a Suspicious Email

1. Do not click any links in the email.
2. Do not open or download any attachments.
3. Do not reply to the sender, even to tell them to stop.
4. If the email impersonates Noiz or a service you use through Noiz, forward it to the Noiz support team as an attachment so the headers can be analysed. See the related article on How to Forward an Email as an Attachment for instructions.
5. Mark the email as spam or phishing in your email client to help train your spam filter.
6. Delete the message after reporting it.
7. If you have already clicked a link or entered any credentials, change your password immediately and contact the Noiz support team for guidance.

When in Doubt, Verify Through Another Channel

If an email claims to be from Noiz, your bank, your registrar, or any other service you trust, and something about it does not feel right, do not act on the email. Instead:

• Log in to the service directly through a bookmark or by typing the address into your browser, and check whether any genuine notice is waiting for you in the account.
• Phone the company on a number you already know to be correct (not the one in the email).
• For Noiz-related concerns, contact the Noiz support team directly through the client area or the published support address.

A few minutes of verification is always worth more than the cost of a successful phishing attempt.

Further Reading

• Google: Avoid and report phishing emails: how to recognise and report phishing from within Gmail.
• Anti-Phishing Working Group: an industry coalition that collects and acts on reported phishing; you can forward suspected phishing to [email protected].