I know this is a leap, but for some reason reading this made me want to buy a domain like virus.porn and make it the most wholesome, lemmy community on the planet.

An actual email sent by my company. (not representative of their usual)

A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a "head office" somewhere far away that set policy and handed out budget and whatnot.

One day "head office" IT decided it was a good idea to send out some fake phishing emails to "test" us. They didn't tell the local IT department about it, I guess they were also being "tested". My manager received one and only recognized it as a phishing attempt after he'd clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.

The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra "dangerous" click my manager did wasn't something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.

Head office never tried a stunt like that again.

I've also never fallen for any of the phising emails the IT department sends to test me, my secret is almost never checking my email

Oh man y'all remember the actual phishing campaign of messages from customer-service@bankofarnerica. com?

So what do you do when you get an actual phishing mail that doesn't use that TLD?

Kemming is 100 level preparedness.

They need to up their game to cover internationalized homograph vulnerabilities, using roughly similar characters from different international alphabets to create totally different domain names:

example.com
exаmple.com

They look identical but are entirely different.

https://en.wikipedia.org/wiki/IDN_homograph_attack

My company is using phishing simulations from a company that puts their company name in the x headers or every email, so that's also easy filter.

As a bonus, that filter also throws all the full security training courses to junk

lucky you. they fail us if we don't right click report phishing.

Mine includes a header so their mail filter knows to ignore it.

At this point, I'm pretty sure that every employee who has been there for more than a month has written or at least copied a filter to delete any email with that header.

I've never been comfortable with that kind of mass deletion and we have, AFAIK, unlimited mailbox storage, so I just set my version to mark those emails as read.

edit: Mail, not mark.

If your company contracts with phish.me then that URL is actually in the email header metadata.

Just set up a rule for the word phish to a special folder, and then you can use the "report" button on everything in that folder to get the credit.