FIVE SAMPLE EMAILS FOR PRACTICE (all addresses and links are fake; .example domains and 203.0.113.x / 198.51.100.x IPs are reserved for documentation)
Do not visit any link. Read the headers and the text only.

==================== EMAIL 1 ====================
Return-Path: <bounce@sbi-kyc-update.example>
Received: from mail.sbi-kyc-update.example (unknown [203.0.113.51]) by mx.google.com
Authentication-Results: mx.google.com; spf=fail smtp.mailfrom=sbi-kyc-update.example; dkim=none; dmarc=fail (p=REJECT) header.from=sbi.co.in
From: "SBI KYC Team" <alerts@sbi.co.in>
Reply-To: kyc-help@sbi-kyc-update.example
Subject: URGENT: Your YONO account will be BLOCKED today
Date: Mon, 6 Oct 2026 07:12:44 +0530

Dear Customer, your KYC is expired. Your account will be blocked within 24 hours.
Update PAN now: Update KYC <http://sbi-kyc-update.example/yono/login.php>
Regards, SBI

==================== EMAIL 2 ====================
Return-Path: <it-helpdesk@infosys-training.example>
Received: from mail.infosys-training.example ([198.51.100.40]) by mx.infosys-training.example
Authentication-Results: mx.infosys-training.example; spf=pass smtp.mailfrom=infosys-training.example; dkim=pass header.d=infosys-training.example; dmarc=pass header.from=infosys-training.example
From: "IT Helpdesk" <it-helpdesk@infosys-training.example>
Subject: Planned VPN maintenance on Saturday 10 Oct, 22:00-23:00 IST
Date: Tue, 7 Oct 2026 10:02:10 +0530

Hello team, VPN will be unavailable on Saturday 10 Oct from 22:00 to 23:00 IST for maintenance.
No action is needed. Details are on the intranet: <https://intranet.infosys-training.example/it/notices/vpn-maintenance>
Ticket: CHG-48812. IT Helpdesk, ext 4040.

==================== EMAIL 3 ====================
Return-Path: <noreply@amazon-in-delivery.example>
Received: from vps-2231.hosting.example (unknown [203.0.113.88]) by mx.google.com
Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=amazon-in-delivery.example; dkim=pass header.d=amazon-in-delivery.example; dmarc=none header.from=amazon-in-delivery.example
From: "Amazon.in Delivery" <noreply@amazon-in-delivery.example>
Subject: Delivery failed - pay Rs 25 re-delivery fee
Date: Mon, 6 Oct 2026 18:40:03 +0530

Your parcel could not be delivered because the address is incomplete.
Pay a small re-delivery fee of Rs 25 within 12 hours or the parcel is returned: Pay now <http://amazon-in-delivery.example/pay?id=IN88213>

==================== EMAIL 4 ====================
Return-Path: <ceo.office.wipro@gmail.example>
Received: from mail-sor-f41.gmail.example ([198.51.100.77]) by mx.wipro-training.example
Authentication-Results: mx.wipro-training.example; spf=pass smtp.mailfrom=gmail.example; dkim=pass header.d=gmail.example; dmarc=pass header.from=gmail.example
From: "Ankit Shah (CEO)" <ceo.office.wipro@gmail.example>
Subject: Quick task - keep it confidential
Date: Tue, 7 Oct 2026 16:55:31 +0530

Are you at your desk? I am in a board meeting and cannot talk.
I need 5 Amazon gift cards of Rs 10,000 each for a client today. Buy them, scratch the codes and send me photos. I will reimburse you. Do not tell anyone.

==================== EMAIL 5 ====================
Return-Path: <refunds@incometax-refund.example>
Received: from unknown (HELO localhost) ([203.0.113.19]) by mx.outlook.example
Authentication-Results: spf=softfail smtp.mailfrom=incometax-refund.example; dkim=none; dmarc=fail header.from=incometax.gov.in
From: "Income Tax Department" <refunds@incometax.gov.in>
Subject: Refund of Rs 18,240 approved - verify bank account
Date: Wed, 8 Oct 2026 08:01:09 +0530
Attachment: Refund_Form_2026.html

Dear Taxpayer, you are eligible for an income tax refund of Rs 18,240.
Open the attached form and enter your net-banking details and OTP to receive the refund.