Lab — Spot the Phishing Email

Lessons 1–3 gave you a checklist that is a mechanism, not a slogan. Sender: expand display name vs From domain; lookalike characters (1 vs l, rn vs m, extra -secure words). Link: hover or long-press in real life; here you only read the URL printed in the sample — you still do not navigate. Urgency and authority in the subject/body. Attachment if present. Ask: password, code, file, or payment? Then verdict: PHISH or LIKELY LEGIT. Likely-legit still does not mean "click a surprise button." It means the sample does not show the classic lure pattern; if you had not expected it, you would still open the official app instead of a link.

Write every sample in the notes file: verdict, at least three flags (or "no lure flags; still no surprise click"), and the safe action. chmod 600 so a shared laptop account does not read your lab. If mkdir or chmod fails on native Windows, use WSL, Git Bash, or macOS/Linux as Topic 4 labs did — or create the file in your user profile and restrict it. Empty files fail the mission. Pasting a live phish from your real inbox into a public gist also fails ethics: this lab is the three samples below, not a collection kit.

Work top to bottom. Sample A and B should score PHISH if you apply lessons 2–3. Sample C is a receipt-style message with no timer, no credential ask, and a shop.example domain that matches the claimed brand in this fiction — still write "if I did not order this, I check the app I already have; I do not hunt the URL." Fill the notes file. Do not add extra live targets because the lab felt short.

From: HR Payroll <[email protected]>
To: [email protected]
Subject: URGENT: Update salary details in 2 hours
Body:
  Dear Employee,
  Direct deposit failed. Sign in to avoid delay:
  http://companv-hr-support.example/login
Attachment: salary_form.html

From: Notifications <[email protected]>
Subject: Package held at customs — $1.99
Body:
  Pay here or the parcel is returned:
  https://fedx-delivery-alerts.example/pay

From: Example Shop Receipts <[email protected]>
Subject: Your order #4821
Body:
  Thanks for your order of a USB cable.
  Track it in the Example Shop app you already installed.
  We will never ask for your password or an SMS code by email.
  No attachment. No "pay a fee to release."

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/phish-lab.txt"

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "ethics: fictional samples only — did not visit hosts, did not send phish"
  echo ""
  echo "=== SAMPLE A (payroll) ==="
  echo "verdict: PHISH / LIKELY_LEGIT"
  echo "flags_sender:"
  echo "flags_link:"
  echo "flags_urgency_authority:"
  echo "attachment:"
  echo "safe_action:"
  echo ""
  echo "=== SAMPLE B (courier fee) ==="
  echo "verdict: PHISH / LIKELY_LEGIT"
  echo "flags_sender:"
  echo "flags_link:"
  echo "flags_urgency_authority:"
  echo "safe_action:"
  echo ""
  echo "=== SAMPLE C (shop receipt) ==="
  echo "verdict: PHISH / LIKELY_LEGIT"
  echo "flags_or_why_quieter:"
  echo "safe_action_if_unexpected:"
  echo ""
  echo "topic4_note: unique passwords + MFA shrink harvest blast radius"
  echo "smishing_note: I still never tap surprise SMS links or forward OTPs"
} > "$NOTES"

chmod 600 "$NOTES"

You practiced the only inspection that stays ethical: read sender, printed link, and pressure; write a verdict; lock the notes. A and B are lures. C is quieter fiction, still not an invitation to wander. Topic 4 still sits under harvest. Next — Quiz — Phishing — ten APPLY items on awareness, email flags, and smishing, then Module 2 opens with Fake Job Scams.