Sources and how the checks work
The official guidance behind threatvetting.com, last reviewed 26 October 2026, and exactly what the link and header checks look for, and what they cannot see.
Official guidance, reviewed 25 October 2026
- NCSC: report a scam email
- NCSC: report a scam text message
- FTC: how to recognize and avoid phishing scams
Added during the October 2026 update
- Apple: recognize and avoid social engineering, Apple Account compromised and clear Safari on iPhone
- Google: secure a compromised account, Play Protect and report spam in Google Messages
- FTC: what to do if you were scammed, refund and recovery scams, unpaid toll texts, QR codes and online shopping
- US Postal Inspection Service: smishing and NCSC: shopping online securely
- Gmail Help: trace an email with its full header, Microsoft: view internet message headers in Outlook and Public Suffix List
- CISA: implementing phishing-resistant MFA
What the link check looks for
The real domain, worked out with a simplified copy of the Public Suffix List (snapshot of 28 December 2025: country endings such as .co.uk and about thirty shared-hosting endings such as github.io, netlify.app and pages.dev), with a warning when the link sits on a hosting service anyone can use; an “@” before the address; a bare IP address; encoded foreign characters (xn--); link shorteners; http instead of https; endings that look like files (.zip, .mov); very long chains of subdomains; well-known brand names, or look-alike spellings of them, outside their own domain; an email address inside the link.
What the header check reads
The SPF, DKIM and DMARC results from the Authentication-Results lines, and whether Reply-To, Return-Path or the display name point to another domain.
What none of this sees
The content of the page behind a link, whether a domain is brand new, or whether a real account was hacked. That is why every result ends with: check through a channel you already know.
Found a mistake or outdated information? Let us know