Phishing Spotter
Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.
Phishing is the entry point for a large share of real breaches, and the defence is pattern recognition built by repetition. Judge each message, then see exactly which signals you caught and which you walked past.
How to use it
- Read each message and decide: genuine or phish.
- Commit to an answer before revealing.
- Study the flags you missed — those are your blind spots.
What to take away
Urgency is the near-universal tell
Almost every phish manufactures time pressure, because thinking is the defence it needs to bypass.
Read the domain right to left
The real domain is the part immediately before the first single slash. paypal.com.secure-login.xyz is not PayPal.
The best ones have no obvious flaws
A well-researched targeted message can be flawless. This is why verification through a separate channel beats inspection.
Frequently asked questions
What is the fastest way to check a suspicious email?
Do not use anything in the message. Open a new tab, type the organisation's address yourself, and check your account there.
What is spear phishing?
Phishing tailored to you specifically, using real details about your job, colleagues or recent activity. Far harder to spot and far more successful.
Does MFA stop phishing?
It stops the reuse of a stolen password, which is most of the value. It does not stop real-time relay attacks or MFA fatigue — phishing-resistant factors like passkeys do.
Where this fits in the course
This security lab pairs with Path 10 — Fundamentals — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Email Header Analyzer — Paste raw email headers and get flagged for From/Return-Path mismatches, SPF failures, and missing DKIM.
- OSINT Sandbox — A safe, fake company profile — practise open-source recon technique without touching anything real.
- Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.
- Prompt Injection Simulator — Chat with a support bot that's told to never reveal its system prompt. Get it to reveal it anyway.