Free tool · Arcade
Pick the Phish
Fifty emails have landed in your inbox. Ten of them are phishing. Work the inbox like an analyst — read the headers, hover the links, check the attachments — and report the ones that are hostile.
How it is scored
- +10 for every phishing email you report
- −6 for every legitimate email you report
- Pass catch 6 of 10 and keep false positives to 3 or fewer
Reporting everything does not work. Precision counts as much as recall — the same as it does on a real triage queue.
Your tools
- 🔎 Show original — full headers with SPF, DKIM and DMARC results
- 🔗 Inspect links — the true destination behind every link
- 📎 Attachments — real filenames, real extensions
Authentication passing does not mean an email is safe. Some of these are sent from genuinely compromised accounts.
Make it your inbox · optional
Enter your name and your organisation's website or domain, and the whole inbox reads like your real one — addressed to you, from colleagues at your domain, with mail that fits your industry. Visual only; it doesn't change the puzzle or the answers.
Leave blank to use the default inbox.
A fresh set of 50 is dealt every time you play.
Optional low-volume ambient music (🔊 in the inbox) — “Deep Haze” by Kevin MacLeod (incompetech.com), CC BY 4.0.
Learn the names for what you are spotting in Phishing attack types explained, or check a link yourself against the usual warning signs, or turn a phishing lesson into a meme.