Phishing links show different content for different users

[Tatarum]

I work in the internal security team of one company and handle the review of suspicious emails that employees forward to us for analysis. I encountered a strange situation: employees report that when they click the links in these emails, they are taken to phishing pages trying to steal corporate data, but when I open the same links myself, they appear to be normal, harmless websites. What could be causing this discrepancy?

[Galileo]

The thing is, you might be using some software that's detected as a bot, and attackers aren't interested in bots because they won't provide any useful data. Real employees, however, work manually, so the malicious software redirects them to phishing pages. If you enter credentials there, your data gets compromised. Read more about this type of malware like Cleantraffic here: behindthesurface.net/ . You need to be extremely vigilant with these threats, otherwise sensitive corporate data could end up in the hands of competitors or attackers.