Phishing trends and threat research you can act on
The Dralvia Research blog turns real suspicious-URL analysis into readable intelligence. Each digest covers the impersonated brands, common lures, attack paths, and infrastructure reuse we see across freshly analysed phishing campaigns, with evidence behind every claim.
What you will find here
- Daily and weekly phishing digests with the top impersonated brands and lures.
- Infrastructure-reuse and redirect-chain patterns across campaigns.
- Practical takeaways for SOC analysts, IT teams, and crypto users.
Guides: protect yourself from phishing
Plain-language, step-by-step guides for everyone, each ending with a free link scan.
What the Dralvia risk score from 0 to 100 means, where the points come from, what Safe, Caution and Avoid ask you to do, and what a score cannot tell you.
Eight quick checks to tell a real link from a phishing link: see the real address, read the domain the right way, spot lookalikes, and scan it for free.
A 30-second checklist for suspicious emails: the real sender, the pressure, the links, the attachments and the request. Plus what to do when you find one.
Clicked a phishing link or typed your password into a fake page? The steps to take right now, depending on what happened, in the order that limits the damage.
How fake delivery, bank, tax and new-number text messages work, the signs that give them away, and what to do if you receive or clicked one.
How fake QR codes on parking meters, posters, emails and PDFs steal logins and card details, and four habits that make scanning a QR code safe.
Fake sign-in pages for Microsoft 365, Outlook and Google are the most common phishing page. How they work, how to tell, and why two-step sign-in is not always enough.
How wallet drainers use fake mints, airdrops and support chats to get one signature that empties a wallet, and the checks to make before you sign anything.
How fake online stores and social media ads take payments for goods that never arrive, and a quick check to run on any shop before you pay.
The few settings that stop most account takeovers: a password manager, unique passwords, passkeys or two-step sign-in, and checking your recovery details.
Browse Dralvia Labs by topic
Dralvia Labs is our research: experiments, threat models, and what we measured. Each topic is a hub that gathers the lab notes on that area. To see lab notes mixed into the archive above, pick Lab notes in the report type filter.
How AI agents get steered by prompt injection, tool calls, and MCP connections, and what stops a risky action before it runs.
Phishing pages, fake-update and paste lures, credential drops, and the hosting and redirect reuse that ties campaigns together.
Risky execution in repositories and AI-generated code: install hooks, hidden payloads, and what a scan catches before you run it.
Wallet signatures, token approvals, and smart-contract traps, plus the checks that show the real intent behind a request.
Making the safe choice the easy choice, so a non-expert can act on a verdict without reading a manual.