21:I[702454,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js","/_next/static/immutable/chunks/181z7f_1svv7z.js","/_next/static/immutable/chunks/0v_ohb1uwrtn-.js","/_next/static/immutable/chunks/230g6czeidmd1.js","/_next/static/immutable/chunks/3vddxkt_6yxv7.js","/_next/static/immutable/chunks/2sclxp840mdso.js","/_next/static/immutable/chunks/2gxp864netdu6.js","/_next/static/immutable/chunks/3k38m3418g5s4.js","/_next/static/immutable/chunks/1imwh2zezh79x.js","/_next/static/immutable/chunks/11t_6dvuhpqqs.js","/_next/static/immutable/chunks/2nx5_d7myyfv2.js","/_next/static/immutable/chunks/2nako0qsny0ux.js","/_next/static/immutable/chunks/24h8wnxeqz0qp.js","/_next/static/immutable/chunks/3-15ikk8fa680.js","/_next/static/immutable/chunks/2_udiw3e83nia.js","/_next/static/immutable/chunks/2n0dbm48nlgy8.js","/_next/static/immutable/chunks/2_g7748w2-o-8.js","/_next/static/immutable/chunks/1hgaz6x18w5zl.js","/_next/static/immutable/chunks/1s5qese6yrc_4.js","/_next/static/immutable/chunks/3a8jhn_2nw1o8.js","/_next/static/immutable/chunks/11o7oj9o45p28.js"],"ReportPageReady"] 22:I[881013,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js","/_next/static/immutable/chunks/181z7f_1svv7z.js","/_next/static/immutable/chunks/0v_ohb1uwrtn-.js","/_next/static/immutable/chunks/230g6czeidmd1.js","/_next/static/immutable/chunks/3vddxkt_6yxv7.js","/_next/static/immutable/chunks/2sclxp840mdso.js","/_next/static/immutable/chunks/2gxp864netdu6.js","/_next/static/immutable/chunks/3k38m3418g5s4.js","/_next/static/immutable/chunks/1imwh2zezh79x.js","/_next/static/immutable/chunks/11t_6dvuhpqqs.js","/_next/static/immutable/chunks/2nx5_d7myyfv2.js","/_next/static/immutable/chunks/2nako0qsny0ux.js","/_next/static/immutable/chunks/24h8wnxeqz0qp.js","/_next/static/immutable/chunks/3-15ikk8fa680.js","/_next/static/immutable/chunks/2_udiw3e83nia.js","/_next/static/immutable/chunks/2n0dbm48nlgy8.js","/_next/static/immutable/chunks/2_g7748w2-o-8.js","/_next/static/immutable/chunks/1hgaz6x18w5zl.js","/_next/static/immutable/chunks/1s5qese6yrc_4.js","/_next/static/immutable/chunks/3a8jhn_2nw1o8.js","/_next/static/immutable/chunks/11o7oj9o45p28.js"],"HostedTrainingView"] 2e:I[865300,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js"],"IconMark"] 23:Tfd2,The next exercises put you in several inboxes. Before you reply or follow a link, inspect the sender, the destination, and the request. These exercises retain organization and destination domains from repository source examples. Some URLs may lead to live or malicious websites. Links are disabled in this simulator. Do not copy or open them outside the simulator. Inspect their text here instead. The seven source messages are adapted examples, not independently verified incident captures. The requested-reset and supplier-payment cases are labeled reconstructions. Personal addresses, usable tokens, and payment details are redacted or fictional; the supplier's name and mailbox are fictional too. A reserved suffix in redacted data is not a verdict about the request. Each exercise supplies known addresses or records separately from the message. ## 1. Check who sent it **Open the message and read the From address.** The display name is a label chosen by the sender. A company name or logo does not prove who sent the message. Read the domain after `@` in the address and compare it with independently known contacts. A legitimate organizer or support provider may use a different domain from the brand. Similar-looking characters can disguise different addresses. In a fictional example, `biIIing.example` contains two capital I characters where `billing.example` contains lowercase l characters. Open sender details or the message's **More actions → View Original** menu to inspect the full address; do not rely on a familiar shape. A familiar address is one check. It does not establish permission for the request. ## 2. Inspect the link destination **Read where the link goes, not just what the button says.** Hover over a link, or click it to show a small destination notice. External navigation is disabled. The notice also explains why you should not copy or open training URLs elsewhere. For the simple HTTPS URLs shown here, the **host** is the website name between `https://` and the next `/`. In the fictional URL `https://orders.larch.example/receipt`, the host is `orders.larch.example`. The `orders` part is a **subdomain**, an address beneath `larch.example`. The domain `larch-support.example` is separate, despite the familiar word. The example hosts here are fictional. Compare that full host with an independently known address. A trusted service can use subdomains or an established outside provider; a different host needs a verified relationship rather than a verdict from its name. Words in a path or query do not change the host. A genuine website link can also be copied into another person's email. ## 3. Read what it asks you to do **Compare the request with your own activity and trusted records.** For example, a fictional bookshop says, "Your paperback order is paid; dispatch details will follow." It reports a completed event. "Confirm a new delivery address" asks for a change. This distinction comes from the request, not the logo on either message. - Did you start the process, and does the message name the account and action you expected? - What access or permission would someone gain from your next step? - Does the message change an existing arrangement or ask you to skip a check? A **recovery phrase** is a wallet's backup words. They can restore access in another wallet application, so another holder may gain control of the wallet. Assess what information can do, not how private or helpful a request sounds. A request can be legitimate even if you did not initiate it, such as a renewal reminder. Urgency alone does not tell you whether it is real. Verify the claim through a route you already trust before acting. ## If you need to verify Do not use the message's link, reply address, or newly supplied contact details as an independent check of that same request. Open the organization's site from a bookmark, type its known address yourself, or use an established separate contact channel. **Next:** open each message in the inbox and apply these checks before answering. 24:T3326,

Dear customer,

Your wallet has been corrupted after the latest server maintenance. To speed up the recovery process, we urge you to follow these instructions:

Open the wallet app on your device.
Navigate to Settings > 'Security & Privacy'.
Click on the button that reads 'Reveal Secret Recovery Phrase'.
Follow the security steps in the app.

After reading the recovery phrase, reply to this confidential email with it. Do not share the secret phrase with anyone else. Our support team will then assist you in recovering your account.

Live support from a security professional is also available, simply access our end-to-end encrypted online help desk.

25:Tce5,

EthCC[8]

Welcome to EthCC[8]

Bonjour,

Thank you for registering for EthCC[8] conference!

We have successfully received your payment, and your ticket for the event has been confirmed. Here are the details of your purchase:

Event:

EthCC[8]

Date:

Monday, June 30, 2025, 9:00 AM - Thursday, July 3, 2025, 4:00 PM

Location:

1 Bd de la Croisette
Cannes 06400
France

Ticket Type:

Speakers

Order Number:

12346465

You will soon receive more information about the programme, speakers, and event logistics.

We look forward to welcoming you to EthCC[8]!

With 💙💛 from Cannes,

The EthCC Team

26:T9e5,

We noticed a suspicious login to your X account from a new device. Was this you?

Location: Berlin, Germany

Device: BraveDesktop on Windows

If it was you, ignore this message. There's no need to take any action.

If it wasn't you, follow these steps now to protect your account:

Request Change Password

For your safety, you'll be logged out of all devices except the one you're using at this time.

X Corp. 1355 Market Street, Suite 900, San Francisco, CA 94103

27:T921,

ENS

Dear user,

We wish to remind you that your ENS domain registration is due to expire next week. Failure to renew your domain will result in the loss of ownership.

To retain ownership and avoid any interruptions, please access your account and finalize the renewal process as soon as possible. The renewal procedure is simple and will ensure the continued smooth operation of your services.

Renew your domain now

Your ENS domain plays a vital role in maintaining your online presence. Keeping it active allows you to uphold your brand identity and secures your digital assets.

Thank you for your attention to this matter. Should you require any assistance, please do not hesitate to contact our support team.

28:T56a,

THE RED GUILD

Security workshop · ETHCC 2025

Hello there!

We're happy to announce that we're delivering a new workshop at ETHCC 2025 - and you're invited!

Please find attached your invitation ticket and further details about the workshop. We look forward to seeing you there!

Cheers,
The Red Guild team.

Find more about us in our website

29:T24f6,

Ecosystem Support Program

Dear grantee,

We're happy to announce that we're reimbursing gas fees for all grant recipients.

To claim your reimbursement, please fill in the form at the following link:

Gas reimbursement form

Please note that the gas reimbursement is only intended to cover your team operations, and will only be available for the next 3 days.

Alternatively, you can also complete the form by filling out the attached PDF, and sending it back to us.

Best regards,
The ESP Team.

2a:T9e5,## Match the message with your context A service can send a genuine email for a process you started. It can also send one because someone else entered your address. Genuine delivery and permission for the named change are different checks. For example, you asked a fictional course portal to change the notification address for member `reader42`. Its message describes a display-name change for `reader43`. Read the account and action separately: those details describe a different process even if the portal itself sent the message. This example does not tell you how to classify every email from that service. A code or reset link can authorize a particular step. Read what that step changes and whose account it affects. Starting one process does not establish a relationship with every later message or destination. A logo or familiar From address cannot supply that context. ## A familiar mailbox can be taken over An attacker with access to a mailbox can write from its real address and reply in an existing conversation. Familiar details and earlier messages can be reused. The sender's appearance does not establish permission for a new arrangement. For example, a fictional community club announces a new meeting organizer. A second reply from the same club mailbox repeats the announcement. Both messages share one source; a membership record established earlier supplies a separate contact route. Count independent sources of confirmation, not the number of replies. For sensitive changes, compare the request with records and verification procedures established outside the current conversation. A changed instruction deserves a check even when the inbox cannot establish who controls the mailbox. ## Apply the method to new contexts The remaining inboxes supply context for each exercise. Read the account, action, and destination together, then decide what the message actually authorizes. Avoid assuming that a genuine sender makes every request yours or that an unfamiliar request must be malicious. The requested-reset and supplier-payment examples are reconstructions, not captured incidents. The reset sender, message, and opaque link token are illustrative, not a captured GitHub template. Its destination lets you compare the full host with an independently chosen bookmark. A host match alone does not authenticate the sender or validate a token. The supplier case uses fictional identifiers for a documented business-email-compromise pattern. Do not copy or open training URLs outside the simulator. 2b:T4a9,Reset your GitHub password

GITHUB

Reset your password

We received a password reset request for you@example.com.

Use the link below to choose a new password.

https://github.com/password_reset/7d92afc68b4310e6d85f209ac4b7631e50d8a927

If you did not request this reset, leave this email alone. Your password will stay unchanged.

We will not ask you to reply with your password or send a reset code to anyone.

GitHub password reset

2c:Tcd7,

Google

Verify recovery email

rhys55103@example.com wants to use your email address as their recovery email. Use this code to finish setting up {email} as a recovery email:

564785

This code will expire in 24 hours.

If you don’t recognize rhys55103@example.com, you can remove your email address from their account.

Remove email

You received this email to let you know about important changes to your Google Account and services.

2d:T416,Re: Invoice NB-1042

Hi,

For invoice NB-1042, the total remains EUR 2,400. Please replace our saved payment account with TRAINING-NEW before you send payment today.

Our old account is being moved. Please skip the usual phone check this time so the invoice is not delayed. Reply here if you need confirmation.

Thanks,
Alex
Accounts, Northbank Studio

Earlier in this thread, Accounts, Northbank Studio wrote:
Invoice NB-1042
Total: EUR 2,400
Payment account: TRAINING-OLD
Thank you for your booking.

11:["$","div",null,{"className":"flex min-h-0 flex-1 flex-col overflow-hidden","children":[["$","$L21",null,{"route":"/trainings/[slug]","context":{"trainingId":"5045609a-300e-44c2-9331-c2c90853a615","trainingSlug":"email-requests"}}],["$","div",null,{"className":"shrink-0 border-b border-ds-line bg-ds-surface py-1","children":["$","div",null,{"className":"container mx-auto px-4 text-center","children":["$","p",null,{"className":"font-copy text-type-caption text-ds-body","children":[["$","span",null,{"className":"mr-2 inline-flex items-center rounded-control border border-ds-accent-ink py-0.5 pl-1.5 pr-1 align-middle","children":["$","span",null,{"className":"font-heading uppercase text-type-eyebrow text-ds-accent-ink","children":"Beta"}]}],"This is a beta version of the platform. Features may change as we collect"," ",["$","a",null,{"href":"mailto:hello@theredguild.org","className":"font-copy text-type-caption text-ds-body underline underline-offset-2 hover:text-ds-accent-ink transition-colors","children":"your feedback"}]," ","and improve it."]}]}]}],["$","$L22",null,{"training":{"id":"5045609a-300e-44c2-9331-c2c90853a615","title":"Email Requests","description":"Check who sent an email, where its links lead, and what it asks you to do. Compare requests with your own activity and trusted records. Verify unexpected or sensitive changes through a route you already trust.","slug":"email-requests","category":"email-security","created_at":"2026-10-07T17:23:14.202252+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","updated_at":"2026-10-07T17:25:16.66852+00:00","scope":"all","tier":"free","isOpenToVisitors":true,"status":"published","allow_retake":true,"estimated_time":20,"level":"beginner","deleted_at":null,"modules":[{"id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","title":"Five inboxes","position":0,"created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","description":"Compare the sender, the link, and the ask.","training_id":"5045609a-300e-44c2-9331-c2c90853a615","sections":[{"id":"fa45f1d1-4dd4-472f-8318-8b709eccb9e3","position":0,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":"e3472287-e740-4acb-a392-7ed8ac8baba6","quizId":null,"type":"lesson","content":{"id":"e3472287-e740-4acb-a392-7ed8ac8baba6","slug":"cafebabe0d06-before-you-act-on-an-email","type":"text","title":"Before you act on an email","status":"draft","content":"$23","pdf_url":null,"category":null,"questions":[],"video_url":null,"created_at":"2026-10-07T17:22:32.708578+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","slides_url":null,"updated_at":"2026-10-07T17:22:32.708578+00:00","visibility":"private","description":"What to look at in a message before you reply or follow a link.","featured_image":null}},{"id":"5ec87daa-5c2b-4f81-994b-8b03f28e59fb","position":1,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"deb30dd6-6a1a-4b16-8bd9-537cdb48f76d","type":"quiz","content":{"id":"deb30dd6-6a1a-4b16-8bd9-537cdb48f76d","slug":"cafebabe0d07-four-requests-in-your-inbox","type":"email","title":"Four requests in your inbox","status":"draft","content":{"theme":"gmail","emails":[{"content":"$24","headers":{"To":"you@example.com","Date":"Jul 01, 2025","From":"Metamask Support ","Subject":"Urgent: secure your wallet now!","Message-ID":"<1761491888816.05fc80b172ebf453@traqc.zendesk.com>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"Metamask Support"},{"content":"$25","headers":{"To":"you@example.com","Date":"Jun 28, 2025","From":"EthCC[8] Ticketing ","Subject":"EthCC[8] registration confirmation","Message-ID":"<1761491888816.13800f5ac8728bf5@ethereum-france.com>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"EthCC[8] Ticketing"},{"content":"$26","headers":{"To":"you@example.com","Date":"Apr 07, 2025","From":"X ","Subject":"New login to your X account","Message-ID":"<1761491888816.87bc8a5ac71f87ad@rgmgt-help-security-x.com>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"X"},{"content":"$27","headers":{"To":"you@example.com","Date":"Mar 03, 2025","From":"ENSDOMAINS ","Subject":"Reminder: Renewal Required for Your ENS Domain","Message-ID":"<1761491888816.33e5b007818f2f8e@ens-kqks3naush2.com>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"ENSDOMAINS"}],"questions":[{"prompt":"You booked an EthCC ticket through its organizer, Ethereum France. Your saved booking lists tickets@ethereum-france.com as its contact. Which message describes a completed purchase without asking you to take a new action?","answers":[{"text":"The EthCC receipt lists a confirmed ticket and says more event information will follow.","isCorrect":false},{"text":"The MetaMask notice describes maintenance and offers support to finish restoring access to your wallet.","isCorrect":false},{"text":"The X notice describes a detected login and offers a password change to secure your account.","isCorrect":false},{"text":"The ENS notice describes an approaching expiry and offers renewal to keep your existing domain.","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Your saved MetaMask support bookmark uses support.metamask.io. Which part of this message would put your wallet at risk?","answers":[{"text":"A support provider outside MetaMask sends the message, so its address alone proves the wallet is compromised.","isCorrect":false},{"text":"The sender offers confidential help, so sending the phrase only in a private reply limits the risk.","isCorrect":false},{"text":"The sender asks for your recovery phrase, which would let someone recreate your wallet and take its funds.","isCorrect":false},{"text":"The linked help desk provides an independent check of the recovery instructions because its support page is separate from email.","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Your saved X bookmark uses x.com. Inspect the reset link in this message. What does its full destination host establish about its relationship to that bookmark?","answers":[{"text":"The destination belongs to x.com because its host includes the service name alongside words about account security.","isCorrect":false},{"text":"The destination uses a separate domain from x.com; its familiar words do not establish that X controls it.","isCorrect":false},{"text":"The destination belongs to x.com because the email sender and the reset link use the same domain name.","isCorrect":false},{"text":"The destination confirms that no login occurred because a different domain cannot describe activity on your X account.","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Your usual ENS bookmark uses ens.app. The email says your domain expires next week. What is the best way to confirm the expiry before acting?","answers":[{"text":"Open the renewal button and compare the page design with ENS before entering any account details there.","isCorrect":false},{"text":"Reply to the email asking for the exact expiry date and renew through its button if the date matches.","isCorrect":false},{"text":"Wait for another renewal reminder before checking the domain, so a second message can establish whether the approaching deadline is real.","isCorrect":false},{"text":"Check your domain through your usual ENS bookmark and renew there if needed without using this email button.","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"Four messages. Compare the sender, the link, and the ask.","instructions":"Your saved bookmarks use support.metamask.io, x.com, and ens.app. You booked an EthCC ticket through its organizer, Ethereum France, and your saved booking lists tickets@ethereum-france.com. Open each message and compare the sender, full destination host, and requested action with that context. Inspect URLs inside the simulator; do not copy or open them elsewhere."}},{"id":"8b1cbde4-802a-4ef0-b7cf-4d7f076cbf22","position":2,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"741e311e-fa8f-4d8f-8c0b-c5af77f0faae","type":"quiz","content":{"id":"741e311e-fa8f-4d8f-8c0b-c5af77f0faae","slug":"cafebabe0d08-two-familiar-organizations","type":"email","title":"Two familiar organizations","status":"draft","content":{"theme":"gmail","emails":[{"content":"$28","headers":{"To":"you@example.com","Date":"Jun 30, 2025","From":"The Red Guild ","Subject":"Upcoming security workshop at ETHCC","Message-ID":"<1761491888816.2eec81c645d339a8@theredguiId.org>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"The Red Guild","attachments":[{"filename":"ticket.pdf","contentType":"application/pdf","sizeInMegabytes":3.8}],"originalFilename":"domain-spoofing-red-guIld.eml"},{"content":"$29","headers":{"To":"you@example.com","Date":"May 05, 2025","From":"The ESP Team ","Subject":"Gas fees reimbursement for grantees","Message-ID":"<1761491888816.b461124743a397e8@ethereum.org>","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"The ESP Team","attachments":[{"filename":"gas-reimbursement-form.pdf","contentType":"application/pdf","sizeInMegabytes":1.2}],"originalFilename":"domain-spoofing-esp-ethereum.eml"}],"questions":[{"prompt":"Your saved Red Guild bookmark uses theredguild.org. The workshop invitation links to that site. What does comparing its From domain show?","answers":[{"text":"The real website link establishes who sent the invitation even when the From domain looks different.","isCorrect":false},{"text":"The familiar ticket filename establishes who sent the invitation even without checking the From domain.","isCorrect":false},{"text":"The workshop details match a public event, which supports treating the invitation as sent by the bookmarked organization.","isCorrect":false},{"text":"The From domain differs by a lookalike character, and the real website link does not verify it.","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Your saved grants-program bookmark uses esp.ethereum.foundation. The gas reimbursement mail shows esp@ethereum.org. How should you verify the offer?","answers":[{"text":"Reply to this email and ask for confirmation before filling in the reimbursement form it provides.","isCorrect":false},{"text":"Use a known organization site or established contact outside this email before supplying any reimbursement details.","isCorrect":false},{"text":"Inspect the linked form design and complete it if the branding matches the organization named in From.","isCorrect":false},{"text":"Fill in the attached PDF instead of the web form because that avoids submitting through an unfamiliar website.","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"Two mails that look like familiar Ethereum organizations.","instructions":"Your saved organization bookmarks use theredguild.org for The Red Guild and esp.ethereum.foundation for the grants program. Open both messages and compare each From address, full destination host, and requested action with those saved addresses. Inspect URLs inside the simulator; do not copy or open them elsewhere."}},{"id":"86ed0e3e-a200-413a-9c74-3a966905e3ff","position":3,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":"63990ef8-83e1-4491-8aba-66899cf68def","quizId":null,"type":"lesson","content":{"id":"63990ef8-83e1-4491-8aba-66899cf68def","slug":"cafebabe0d04-when-the-sender-is-real","type":"text","title":"When the sender is real","status":"draft","content":"$2a","pdf_url":null,"category":null,"questions":[],"video_url":null,"created_at":"2026-10-07T17:22:32.708578+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","slides_url":null,"updated_at":"2026-10-07T17:22:32.708578+00:00","visibility":"private","description":"The logo and the From address can both be genuine. That still does not make the request yours.","featured_image":null}},{"id":"c5407c71-03c8-44a5-83d1-95c71665f483","position":4,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"823bd777-3a1f-4f59-8f15-ee504ec89350","type":"quiz","content":{"id":"823bd777-3a1f-4f59-8f15-ee504ec89350","slug":"reset-email-you-requested","type":"email","title":"A reset you requested","status":"draft","content":{"theme":"gmail","emails":[{"content":"$2b","headers":{"To":"you@example.com","Date":"Sun, 04 Oct 2026 10:05:00 +0000","From":"GitHub ","Subject":"Reset your GitHub password","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"GitHub"}],"questions":[{"prompt":"You requested a reset for you@example.com through your GitHub bookmark. Inspect the reset link. Which statement correctly compares its destination with the bookmark you used?","answers":[{"text":"The full host is password_reset because that part names the action the linked page would perform.","isCorrect":false},{"text":"The full host includes the opaque final segment because that segment identifies a separate site for this request.","isCorrect":false},{"text":"The full host is github.com, matching the host of the bookmark you used to request this reset.","isCorrect":false},{"text":"The full host is com because only the final part of an address determines which service receives it.","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"A reconstructed GitHub reset response lets you inspect a realistic destination and compare its full host with your own bookmark.","instructions":"This scenario establishes a genuine response to the GitHub password reset you requested through your usual bookmark at https://github.com/password_reset for you@example.com. The sender, copy, and opaque link token are illustrative, not a captured GitHub template or usable recovery token. Inspect the destination inside the simulator; do not copy or open it elsewhere."}},{"id":"44275a6a-70c0-4359-92b4-72b2df5db2e7","position":5,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"88063106-8687-4a4d-b5c9-ed2f67f1942a","type":"quiz","content":{"id":"88063106-8687-4a4d-b5c9-ed2f67f1942a","slug":"cafebabe0d09-a-google-recovery-email","type":"email","title":"A Google recovery email","status":"draft","content":{"theme":"gmail","emails":[{"content":"$2c","headers":{"To":"you@example.com","Date":"Fri, 05 Jun 2026 18:47:35 +0100","From":"Google ","Subject":"Use 564785 to set up recovery email","Reply-To":"noreply@google.com","Message-ID":"","Return-Path":"bounce@google.com","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"Google"}],"questions":[{"prompt":"This scenario establishes that the message genuinely came from Google. You did not request a recovery-email setup and do not recognize the account named in the body. Which response fits the account and change this code would authorize?","answers":[{"text":"rhys55103@example.com requested the recovery setup. Keep the code private and leave the unfamiliar setup alone.","isCorrect":false},{"text":"rhys55103@example.com requested the recovery setup. Reply with the code so they can confirm they own that account.","isCorrect":false},{"text":"Your own account requested the recovery setup. Enter the code to unlock it because Google sent the notice.","isCorrect":false},{"text":"Your own account requested the recovery setup. Forward the code to your support contact to cancel the request.","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"Another account wants your address for recovery and includes a code.","instructions":"This scenario establishes that the message genuinely came from Google. You did not request a recovery-email setup and do not recognize the account named in the message. Read which account wants your address and what the code would confirm before answering. The requester address and link token are redacted training values; inspect URLs here without copying or opening them elsewhere."}},{"id":"059360aa-8e21-4fd3-ae91-699cf636b953","position":6,"module_id":"8209371c-57f9-4fa1-956b-de30fd28fd6b","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"6cc42c22-a8cf-4476-aabe-c4c5ab009494","type":"quiz","content":{"id":"6cc42c22-a8cf-4476-aabe-c4c5ab009494","slug":"vendor-payment-change","type":"email","title":"A supplier changes payment details","status":"draft","content":{"theme":"gmail","emails":[{"content":"$2d","headers":{"To":"you@example.com","Date":"Sun, 04 Oct 2026 10:10:00 +0000","From":"Accounts, Northbank Studio ","Subject":"Re: Invoice NB-1042","Content-Type":"text/html; charset=UTF-8","MIME-Version":"1.0"},"fromName":"Accounts, Northbank Studio"}],"questions":[{"prompt":"This supplier-payment scenario uses fictional business and payment details. Your saved Northbank Studio record, outside this email, lists invoice NB-1042 for EUR 2,400, payment account TRAINING-OLD, and a phone contact for your usual payment-change callback. accounts@northbank.example is the supplier's genuine mailbox in this scenario. What should happen before changing the payment account in its latest reply?","answers":[{"text":"Reply to accounts@northbank.example asking for confirmation, then update the account if the same address confirms it.","isCorrect":false},{"text":"Pause the payment change and call the supplier using the phone contact already saved in your records.","isCorrect":false},{"text":"Keep the invoice amount unchanged and pay TRAINING-NEW because the supplier used its genuine email address.","isCorrect":false},{"text":"Use contact details supplied in the latest reply to verify the replacement account before updating the record.","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"A reconstruction of supplier-email compromise uses fictional business and payment details.","instructions":"This is a reconstruction of the documented business-email-compromise pattern, not a captured Northbank Studio incident. The business name, mailbox, invoice, amount, and payment account labels are fictional. You handle supplier payments. Your saved record outside this email lists invoice NB-1042 for EUR 2,400, account TRAINING-OLD, and your usual callback contact. In the scenario, accounts@northbank.example is the genuine supplier mailbox. Read the latest reply and compare it with your saved record."}}]}]},"backLink":{"href":"/trainings","label":"Back to Trainings"},"isPreviewMode":false,"tutorEnabled":false,"canReportProblem":false}]]}] 14:null 18:[["$","title","0",{"children":"Email Requests • Phishing Dojo"}],["$","meta","1",{"name":"description","content":"Learn to identify and protect yourself from phishing attacks"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.3adr5hz73_o_x.ico","sizes":"64x64","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/icon.png?icon.3adr5hz73_o_x.png","sizes":"64x64","type":"image/png"}],["$","link","4",{"rel":"apple-touch-icon","href":"/apple-icon.png?apple-icon.3ed4naihy3sg8.png","sizes":"180x180","type":"image/png"}],["$","$L2e","5",{}]]