All labs

Spot the phish

Inspect simulated messages the way an analyst does — the sender, the links, the headers — and learn what actually gives a phishing attack away, not just what sounds urgent.

Briefing

You're the one deciding whether each message in the queue is safe. Instead of reacting to how urgent it sounds, you check the sender, the links and the headers — the parts that actually give a phishing attack away.

You'll learn to

  • Read a From display name apart from the real address
  • Spot a lookalike domain and a link that doesn't go where it says
  • Use SPF, DKIM and DMARC results as evidence
  • Call phish or legit from the evidence, not the tone
0 of 7 steps done0%
Start: How phishing works
Before you open that emailOptional warm-upDisplay names, lookalike domains, SPF/DKIM/DMARC, and what to do instead of clicking. Ten minutes.

  1. How phishing works

    Up next

    The pattern under every attack

  2. The display name

    Anyone can type a name into the From field

  3. Lookalike domains

    One character can rebuild an entire brand

  4. Where the link goes

    Text is a promise. The destination is the fact.

  5. Read the headers

    When the display name checks out and it still isn’t them

  6. Phish or legit

    Four messages. Evidence, not tone.

  7. What to do next

    Verify, don’t click. Report, don’t ignore.