Email Header Inspection
Real phishing emails leave fingerprints in their headers. Click each email to expand its raw headers, then drag each email to the correct bin below.
From: field you see in your inbox can be forged — but headers like Return-Path and the Received chain reveal the true origin. Click on a header field to learn what it means.
Drag each email to the right bin — or click the buttons if drag isn't your thing:
🚨 Suspicious / Phishing
✅ Legitimate
Authentication Check
SPF, DKIM, and DMARC are the email system's trust certificates. Read the mock DNS panel for each scenario and determine whether the email would pass or fail authentication.
URL Dissection
Attackers hide malicious domains in URLs that look legitimate at a glance. Can you find the REAL domain before you click?
login.paypal.com.evil.com/verify, the actual domain is evil.com — everything before the last dot before the path is subdomains. Attackers also use lookalike characters: paypaI.com (capital I, not lowercase L) and Cyrillic letters that look identical to Latin ones.
Click each colored part to learn what it means:
Incident Response Simulation
A teacher at Lincoln Middle School just clicked a phishing link. You're on the response team. Work through the steps — skipping one shows you what happens next.
🚨 Active Incident — Lincoln Middle School
Mr. Okafor received an email claiming his Google account was suspended. He clicked the link and entered his credentials before realizing it was fake. The link was google-accounts-verify.tk/login — not Google. Your job: contain this before it spreads.
Build a Phishing Filter
Toggle the rules you want to activate. Then test your filter against 20 emails — real-world phishing and legitimate messages. Tune for fewer misses without too many false positives.
Available Rules
(phishing caught)
(legit blocked)
(phishing slipped)
(TP ÷ all phishing)
| Sender | Subject | Type | Your Filter | Result |
|---|