Lab 10 · Spot the Phishing Lab: Analyse Safe Sample Messages

🎯 Objective

Train the professional skill of phishing triage: slow, structured analysis with written evidence, not gut feeling.

🧩 Skills You Will Practice

• Sender and domain inspection
• URL analysis
• Social-engineering language patterns
• Incident reporting

🧰 What You Need

• This lab page (all samples below are fictional and safe)
• A notebook with a 4-column table: Sender, Link, Language, Request
• The Phishing lesson open for the 7 warning signs

📋 Step-by-Step Tasks

1. SAMPLE A — From: Instagram Support at support@insta-verify-login.xyz — Dear user, your account will be deleted in 2 hours. Verify now: insta-verify-login.xyz/confirm. In your table, list every red flag with the exact words or characters that prove it.
2. SAMPLE B — From: Bank Security at alerts@secure-bank-update.com — Urgent: reply with your card number and OTP to stop a fraud transaction. Analyse why a real bank would never make this request, and what the correct user action is (official app, number on the card).
3. SAMPLE C — A delivery SMS: Your parcel is held. Pay Rs 150 fee: track-parcel-fast.link/pay — plus a SAMPLE D: a prize message you won a phone in a contest you never entered, and SAMPLE E: a university message asking you to sign in through a link whose domain differs by one letter from the real one.
4. For each sample, count total red flags and assign a verdict: Phishing — Do not click / Report / Delete. Samples with 3+ flags must be reported in your notes with the reporting step you would take in the real app.
5. Write the one safe procedure that defeats all five samples in your own words: stop, open the official app or type the address yourself, check inside the account, never share codes.
6. Create one fictional phishing sample of your own for teaching (never send it to anyone), plant exactly 4 red flags, and write the answer key that exposes each one.

✅ Expected Result / Deliverable

A completed triage table for 5 samples with evidence-based verdicts, the universal safe procedure in your own words, and one original teaching sample with its answer key.

⚠️ Common Mistakes

• Judging by the logo or design quality — professionals judge sender, domain and request
• Clicking a real suspicious link to check it
• Forwarding a phishing message to friends as a joke (it spreads the bait)