Urgent: verify your mailbox in 15 minutes
Dear user, click http://secure-mail-login.example.tk to keep your account. IT Support
Tips for phishing practice
Check sender domain spelling and reply-to mismatches.
Hover links — look for unexpected hosts before clicking.
Urgent payment or credential requests are classic pressure tactics.
Verify sensitive requests out-of-band (known phone/chat).
Report suspicious messages instead of forwarding widely.
Practice spotting phishing, with fake mail
Each card is a made-up message. You decide phishing or legit, then see why. Nothing here is a real inbox and nothing is sent as email.
Use it for onboarding or a five-minute refresher — not as a license to test colleagues without permission.
Phishing trainer FAQ
Are these real emails from our company?
No. Scenarios are fictional. Sender domains are examples.
Does a score get uploaded?
No. Progress stays in this tab.
Can I use this to phish my team?
Not from this page. Simulated phishing campaigns need consent and a proper program. This is recognition practice only.