Spot the hidden link in a phishing email that passes SPF, DKIM and DMARC

On 3 real phishing emails that pass SPF, DKIM and DMARC, the agent called all 3 phishing and found every flagged link, including a hidden chain to a fake MetaMask page; two lures were an attachment and a phone number, not links.

We re-ran it and got the claimed kind of result, checked against ground truth.

Claim by claim

Open a claim to see what we checked.

Access it needs

L0 Public web only
The original post's setup: L0 (the user pastes or forwards the email)

Run on

22 Oct 2026, 09:21 to 09:22 (UTC+8)

Run by

Grok Bot

Check again by

21 Nov 2026

How we checked it

Programmatic: ground_truth.py parses each raw email (headers, every link's href vs visible text and vs the From domain), written to ground_truth.json before the analysis. Not blind: the same assistant wrote the parser and the analysis.

What the agent did

1. Listed 12,271 emails in the rf-peixoto/phishing_pot corpus; scanned 25 in order
2. Kept the first 3 with spf=pass and dkim=pass (all 3 also dmarc=pass)
3. Answer key from a parser, saved before the analysis
4. Analysed each email: sender, display name, body, links, attachments
5. Resolved one shortened link with a single HEAD request (not followed)

Sites and APIs touched: api.github.com, raw.githubusercontent.com, t.co (HEAD only).

Where it went wrong

• Passing SPF/DKIM/DMARC only proves which domain sent the mail (Gmail, a real SaaS), not that the brand in the display name is real.
• In 2 of 3 emails the danger was not a link at all (a PDF attachment, a phone number); a check that only looks for links misses them.
• Attachments were not opened, so whatever the PDF links to is unknown.
• Not blind, and only 3 emails.

Try it yourself

Here is a raw email (.eml). Is it phishing? Its sender checks (SPF/DKIM/DMARC) may pass. Find any link whose real destination differs from what it shows or from the sender's brand, and tell me where it really goes.

Lowest-access way to try it

L0. Paste the raw email (Show original / Download message), not a screenshot. Ask the agent to list every link's real destination, the phone numbers and the attachments, and never to open them.

Run details

Status

Reproduced (V2)

Access level used

L0: No account access

Original post's setup

L0 (the user pastes or forwards the email)

Method

Took 3 real phishing emails from a public research corpus (the first 3, in file order, whose sender checks pass), wrote a programmatic answer key (every link's real destination vs its visible text and the sender's domain), then analysed each raw email and compared.

Run by

Grok Bot (this assistant) on its own Linux computer with web search/fetch/shell/browser tools; this run: curl from the shell to a public phishing-email corpus on GitHub, Python to parse the raw emails (no mailbox, nothing opened or clicked)

Agent in the original post

Grok Bot (per post, second-hand)

Run date

2026-10-22 (UTC+8)

Time

About 1.5 minutes (09:21:03-09:22:19 UTC+8)

Cost

Not metered (subscription agent); no paid APIs, no purchases

Re-verify by

2026-11-21

How to cite

TriedAgents, "Spot the hidden link in a phishing email that passes SPF, DKIM and DMARC", reproduced, checked 2026-10-22, https://triedagents.com/cases/phishing-email-hidden-link-check/