Signal Check Defensive awareness lab

Field guide 01 Human-layer security

Pause the pressure.
Trace the signal.

Phishing works by rushing people past the details. This interactive training turns those details into a repeatable habit: pause, inspect, verify, report.

Start the training Try a scenario
Created by
Mahmoud Abdullah
Internship
CodeAlpha Cyber Security
Format
Self-paced awareness lab

Fictional message inspection

Evidence trace

Simulation
From Accounts Team <notice@account-verify.example>
Subject FINAL NOTICE — mailbox closes today

We detected a problem. Confirm your mailbox immediately at the secure page below.

northstar.example.account-verify.example

Select an evidence label to inspect the message.

Prepare Learning objectives

What you will be able to do

By the end of this module, you should be able to recognize common phishing signals and choose a safer response.

01

Recognize

Identify common phishing channels, pressure tactics, and suspicious requests.

02

Inspect

Check sender addresses, registered domains, links, attachments, and login pages.

03

Verify

Confirm unusual requests through a separate, trusted communication channel.

04

Report

Use the reporting process provided by your organization, school, or local authority.

Understand The attack pattern

What is phishing?

Phishing is a deceptive attempt to persuade someone to reveal information, send money, install software, or take another unsafe action.

It is a form of social engineering: the attacker targets human judgment rather than relying only on a technical vulnerability. Messages can arrive through email, text, phone calls, social media, QR codes, or websites.

Recognize Six common forms

Phishing changes its channel, not its goal.

Different formats use the same core idea: borrow trust, apply pressure, and prompt an unsafe response.

EML

Email phishing

Broad messages imitate familiar services or teams and push links, attachments, payments, or data requests.

SPR

Spear phishing

Targeted messages use researched names, roles, projects, or relationships to appear unusually relevant.

SMS

Smishing

SMS or chat messages exploit small screens, shortened previews, and quick reactions to suspicious links.

VOC

Vishing

Voice calls use confidence, caller-ID spoofing, or fabricated emergencies to request secrets or actions.

BEC

Business email compromise

Attackers impersonate or compromise executives, vendors, or colleagues to redirect money or sensitive data.

WEB

Fake login websites

Look-alike pages copy familiar layouts to capture passwords, payment data, or multifactor authentication codes.

Inspect Read the evidence

Eight checks before you trust a message

No single clue proves phishing. Several clues together should make you stop and verify.

  1. 01

    Expand the sender address

    Ignore the display name at first. Check the full address, spelling, and domain against a trusted contact record.

  2. 02

    Read the domain name carefully

    Look for added words, swapped letters, lookalike characters, misleading subdomains, or an unrelated registered domain. Compare the address with a known source instead of trusting its appearance.

  3. 03

    Preview the real URL

    On desktop, hover without clicking. On touch devices, use a safe preview if available. When uncertain, do not open it.

  4. 04

    Notice language quality

    Unexpected tone, unusual greetings, spelling errors, grammar problems, or vocabulary unlike the sender can be clues.

  5. 05

    Treat attachments as untrusted

    Unexpected archives, documents, disk images, and executables may be dangerous—even when the filename looks ordinary.

  6. 06

    Challenge urgent requests

    Deadlines, secrecy, threats, unusual payments, gift cards, and sudden account problems deserve independent verification.

  7. 07

    Question unfamiliar login pages

    A sign-in page reached from a message is higher risk. Close it and use a known bookmark or type the trusted address yourself.

  8. 08

    Treat QR codes and shortened links cautiously

    Do not scan or open them from an unexpected message. Use a known app, bookmark, or typed address instead.

Decode Fake website detection

A polished page can still have the wrong address.

Logos and layouts are easy to copy. The address bar provides stronger evidence.

Expected fictional address

https://accounts.northstar.example/signin

The service name is a subdomain. The organization’s fictional domain is northstar.example.

Deceptive fictional address

https://northstar.example.verify-login.example/session

The important domain is verify-login.example. “northstar.example” is only placed before it.

Inspect before entering anything

  • Compare the exact domain with a trusted bookmark or official documentation.
  • Look for misspellings, extra hyphens, unrelated words, and confusing subdomains.
  • Be cautious when a page requests passwords, recovery codes, payment data, or downloads.
  • Use a password manager; failure to autofill can warn that the domain does not match.

Interpret Emotional triggers

Notice what the message wants you to feel.

Emotion is not evidence. Naming the tactic creates enough distance to make a safer decision.

Clock

Urgency

“Act now” compresses decision time and discourages verification.

Alarm

Fear

Threats of loss, punishment, or account closure trigger fast reactions.

Rank

Authority

A claimed manager, official, or technician pressures people to obey.

Gap

Curiosity

Unexpected photos, files, news, or secrets invite a risky click.

Prize

Rewards

Refunds, jobs, gifts, and wins make an unlikely offer feel urgent.

Mask

Impersonation

Copied names, voices, branding, and writing styles borrow someone else’s trust.

Practice Realistic fictional examples

Move from suspicion to a safe next step.

Every organization and address below is invented for training. None of the examples link to a login or collect information.

Email

Shared document lure

“Nadia, review the confidential evaluation before 4:00.” The context feels personal, but the sender domain is unrelated.

Safe move: ask the evaluator through a known contact method.

Text

Delivery fee

“Your parcel is held. Pay EGP 12 now.” The unexpected fee and shortened link encourage a quick tap.

Safe move: check the courier’s known app or typed address.

Call

Support code request

A caller knows your name and asks for an MFA code to “stop an attack.” That code may approve the attacker’s login.

Safe move: end the call and contact support independently.

Exercise Spot the Phish

Classify four message signals

0 of 4 reviewed
EmailFictional

From: Training Desk <review@internship-check.example>

Final score sheet — private

Open Score_Sheet.html and sign in before 15:00 or your submission will be removed.

TextFictional

Sender: +20 000 000 0000

Parcel delivery paused

Pay a small redelivery charge at parcel-release.example within 30 minutes.

CallFictional

Caller ID: “Project Manager”

Urgent file request

The caller asks you to send an unpublished report to a new personal email address.

Internal noticeFictional

Posted in the already-bookmarked Northstar training portal

Planned maintenance

The portal will be read-only Saturday. No link, download, login, payment, or response is requested.

Harden Prevention checklist

Build habits that survive a convincing message.

Mark each action as you review it. This practice checklist stays on this page and is not sent or saved.

0 of 6 reviewed

Assess Interactive quiz

Can you choose the safer response?

Fourteen questions test recognition, inspection, verification, and reporting. Your quiz progress is stored only in this browser’s localStorage.

Question 1 of 14

0% answered

0 of 14 answered
Loading question…

Select one answer to continue.

Respond Resources and reporting

Report early. Recover methodically.

If a message targets a workplace or school, use its established report-phishing button, security team, or help-desk process first.

1

Do not interact further

Avoid replying, opening attachments, using links, or calling numbers inside the suspicious message.

2

Preserve and report

Use the approved reporting channel. Follow local guidance before deleting the message.

3

If you entered a password

Contact the relevant support or security team, report the incident, and change that password from a trusted device. Review active sessions and change it anywhere else you reused it.

4

If you opened a file or installed software

Stop using the affected device, isolate it according to organizational guidance, and contact your security team immediately. Do not continue browsing or investigate it yourself.

CISASecure Our WorldPhishing, passwords, MFA, and updates FTCRecognize and avoid phishingPractical recognition and response guidance FTCReportFraudUnited States fraud reporting resource

These external resources are educational. Follow the laws and reporting procedures that apply in your country and organization.

Remember Final takeaways

Pause. Inspect. Verify. Report.

A convincing message can still be fraudulent. Use these four steps whenever a request feels unusual, urgent, or sensitive.

1

Pause

Do not let urgency decide for you.

2

Inspect

Check the sender, domain, link, attachment, request, and context.

3

Verify

Start from a trusted contact method, bookmark, or official app.

4

Report

Share suspicious messages through the approved channel before deleting them.

About Project context

A defensive learning project by Mahmoud Abdullah.

This module was created for the CodeAlpha Cyber Security Internship as a practical phishing-awareness project. It uses semantic HTML, responsive CSS, and vanilla JavaScript, with no external UI framework.

All names, organizations, domains, messages, and scenarios used in the training examples are fictional. The project does not reproduce a real login page, collect credentials, create malicious links, or enable impersonation.

Ethical use

Use this material to improve recognition, reporting, and safer decision-making. Do not adapt it to deceive people or imitate real organizations.