🧪 VIYUH BDR TEST — LIVE-MAIL1 replica · SAFE LOCAL SIMULATION (nothing is sent anywhere)

Why this page exists: Gmail blocks the .exe attachment at its gateway, so the real LIVE-MAIL1 email can never be delivered to test BDR. This page renders the IDENTICAL message (same look-alike link + same double-extension attachment) with no gateway in the way, so BDR's webmail-response rule runs exactly as it would on a mail system without that block.

The two tricks: (1) the button links to paypa1.com — a "1" not an "l", a look-alike of paypal.com. (2) the attachment invoice.pdf.exe uses the classic double-extension trick — the REAL extension is .exe (an executable), not .pdf.

✅ With VIYUH BDR ON you SHOULD see TWO detections: a HIGH warning "phishing link in gmail message → look-alike of paypal", AND a MEDIUM warning "risky attachment in gmail message (.exe)".

👉 LIVE-MAIL1 = PASS if you saw BOTH the HIGH link warning and the MEDIUM attachment warning (and a bdr:webmail-response incident on the dashboard).

[Action Required] Your PayPal account access has been limited

PayPal Service <service@paypal-account-security.com>

to me ▾

10:02 AM
★ ↩ Reply

Dear customer,

We detected unusual activity on your account, so we have temporarily limited some features. To restore full access, please confirm your identity and review the attached invoice for the flagged transaction.

Confirm my account

Link destination shown by your mail client: http://paypa1.com/login?case=PP-4471-2290

If you do not confirm within 24 hours, your account will remain limited.

1 Attachment

PDF
.EXE invoice.pdf.exe 312 KB