# Sources and how the checks work

> The official guidance behind threatvetting.com, last reviewed 26 October 2026, and exactly what the link and header checks look for, and what they cannot see.

- Canonical URL: https://threatvetting.com/sources/
- Checked: 2026-10-26

## Official guidance, reviewed 25 October 2026

- [NCSC: report a scam email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email)
- [NCSC: report a scam text message](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message)
- [FTC: how to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)

## Added during the October 2026 update

- [Apple: recognize and avoid social engineering](https://support.apple.com/en-us/102568), [Apple Account compromised](https://support.apple.com/en-us/102560) and [clear Safari on iPhone](https://support.apple.com/en-us/105082)
- [Google: secure a compromised account](https://support.google.com/accounts/answer/6294825?hl=en), [Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en) and [report spam in Google Messages](https://support.google.com/messages/answer/9061432?hl=en)
- [FTC: what to do if you were scammed](https://consumer.ftc.gov/articles/what-do-if-you-were-scammed), [refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams), [unpaid toll texts](https://consumer.ftc.gov/consumer-alerts/2025/01/got-text-about-unpaid-tolls-its-probably-scam), [QR codes](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information) and [online shopping](https://consumer.ftc.gov/articles/online-shopping)
- [US Postal Inspection Service: smishing](https://www.uspis.gov/news/scam-article/smishing) and [NCSC: shopping online securely](https://www.ncsc.gov.uk/guidance/shopping-online-securely)
- [Gmail Help: trace an email with its full header](https://support.google.com/mail/answer/29436?hl=en), [Microsoft: view internet message headers in Outlook](https://support.microsoft.com/en-us/topic/cd039382-dc6e-4264-ac74-c048563d212c) and [Public Suffix List](https://publicsuffix.org/)
- [CISA: implementing phishing-resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)

## What the link check looks for

The real domain, worked out with a simplified copy of the [Public Suffix List](https://publicsuffix.org/) (snapshot of 28 December 2025: country endings such as .co.uk and about thirty shared-hosting endings such as github.io, netlify.app and pages.dev), with a warning when the link sits on a hosting service anyone can use; an “@” before the address; a bare IP address; encoded foreign characters (xn--); link shorteners; http instead of https; endings that look like files (.zip, .mov); very long chains of subdomains; well-known brand names, or look-alike spellings of them, outside their own domain; an email address inside the link.

## What the header check reads

The SPF, DKIM and DMARC results from the Authentication-Results lines, and whether Reply-To, Return-Path or the display name point to another domain.

## What none of this sees

The content of the page behind a link, whether a domain is brand new, or whether a real account was hacked. That is why every result ends with: check through a channel you already know.

---
Threat Vetting · Contact: contact@threatvetting.com