Lion Cipher Lab
Spot a phishing email — safely
- SOC Analyst / Blue Team
- Beginner
- ~25 min
- Free · no account required
Why it matters
Phishing is the front door of the overwhelming majority of real attacks: an email that tricks a human into clicking a link, opening an attachment, or handing over a password. Being able to look at a message and judge "is this real, or is someone trying to fool me?" without taking the bait protects your own accounts, your money, and — the day you work a security desk — your whole organisation. On a SOC (Security Operations Centre) team, reviewing suspicious emails that staff have reported is one of the first, most constant jobs a junior analyst is handed. The skill is pure observation:…
What you'll learn
- recognising phishing
- reading the real sender address
- inspecting links without clicking
- reading email headers
- reporting suspicious email
Steps in this lab
- The one rule: examine, never interact
- Check the REAL sender address, not the display name
- Hover over links to see where they REALLY go — without clicking
- Read the tells — the pattern phishing almost always shows
- Read the headers — where the message really came from
- What to DO with it: report, don't click, don't reply, delete
- Why this small skill is a big deal