Demo: What a Phishing Page Looks Like

Below is a simulated phishing page. Red annotations show what attackers exploit and what employees should notice.

🚩 RED FLAG: Fake URL

https://linkedin-verify-account.com/secure-login

Not linkedin.com — attackers register lookalike domains. Always check the full domain.

🎭 Simulated Fake Login Page

in LinkedIn

Your account requires verification. Please sign in to confirm your identity.

⚠️ Urgency language — designed to make you act without thinking

⚠️ These fields send your credentials to the attacker's server, not LinkedIn

By signing in you agree to our Terms of Service

⚠️ Looks identical to the real site — attackers copy HTML/CSS exactly

👁️ What happens silently before you type anything

✓ Your IP address logged → approximate location identified

✓ Browser & OS fingerprinted → device identified

✓ Canvas fingerprint generated → unique device ID created (persists across incognito)

✓ Screen size, language, timezone captured

✓ Time of visit, referrer URL logged

✗ None of this requires you to click "Sign in"

Always verify the full domain name in the address bar before typing anything
Urgency ("verify now", "your account will be suspended") is a manipulation tactic
Phishing pages look pixel-perfect — appearance alone doesn't prove legitimacy
Data collection starts the moment the page loads — even closing it quickly may be too late
Use a password manager — it won't autofill on fake domains
When in doubt, go to the site directly by typing the URL, not via a link

🎣 What a phishing page looks like