Free · In this browser · Answers stay here
Phishing Inbox Simulator
Fourteen fictional emails. Some are ordinary, some are phishing. Mark each one Safe or Phish, then read why. The sender address is on the message, and the real link address shows when you hover, focus, or tap. Nothing is uploaded.
- Read the address The name is a costume. The part after the @ sign is the sender.
- Check the link The button text can lie. The real address is the one that would open.
- Name the pressure A hurry, a prize, a file, or a secret is a cue, not proof by itself.
Inbox
Answered 0 of 14
Best on this device: none yet.
The sample inbox loads in this browser.
How to read a message before you trust it
The display name is the costume. The address next to it is the sender. A note can say Northwind Security and still arrive from a site you have never used. Read the part after the @ sign, then read that host from the right. In this inbox the company is the name just before .example. In real mail it is the name just before .com, .org, or the country ending. Extra words glued on, such as northwind-alerts.example instead of northwind.example, are a different site that borrowed the brand.
Then look at the link, not the label. The words on a button can say rivermark.example while the real address is another host. This page prints that real address under the link. On a computer, hover or focus the link and it lights up. On a phone it is already on the screen, and a tap pins it open. Nothing here navigates. The domains use .example, which is reserved for examples, so there is no live site on the other end and no file to download.
A hurry is not evidence
“Locked in two hours” and “disconnects tomorrow” are there to make you skip the address. A real date can be legitimate too: a library hold, or benefits enrollment that closes on a calendar day. The rest of the message is the difference. A matching sender, a matching link, and no demand for a password or a gift card is a different shape from a threat.
Attachments are files you did not ask for. A bill that arrives as a web page, named like Invoice-1044.htm, is not a PDF. A note that tells you to enable content is asking the computer to run something. You do not need to open it to see that the shape is wrong.
Quiet mail can still be fake
A prize that expires at midnight, or a desk that wants gift-card codes and asks you not to tell anyone, is a script. Calm mail can be fake too. One note in this set does not shout. It only wants a password on a host that looks like the company if you stop reading early. The brand sits on the left. The site you would actually open sits on the right.
A password reset from the real domain, with a link to that same domain, is not automatically a phish. If you did not request it, you still do not have to click. Ignore it and open the service from a bookmark. This exercise marks that kind of note as legitimate because the cues match, and the explanation says so after you answer.
Your best score stays in this browser. The individual answers are not saved and are not sent. When a real link shows up outside this page, the link checker reads the address the same way, still without opening it. Choose Your Own Hack walks the same habits as a story: a text, a call, or a cafe network, and the choice is yours. Tech Myth or Fact tests the claims people repeat about private browsing, phone batteries, and passwords. The Password Habit Quiz scores the habits around reuse and a second factor, and it never asks for a password. The password you would have typed belongs in the password strength checker, which also stays on this device.
FAQ
Does this upload my answers?
No. The quiz runs in your browser. The only thing saved is your best score, in this browser's local storage. Individual answers are not stored and are not sent to analytics. You can confirm that in the network panel: marking an email adds no request.
Are the companies or people real?
No. The brands are fictional, and the only person named is Alex Example, a placeholder. Every domain uses .example, which is reserved for examples and is not a live website.
Will a link in the inbox open?
No. Choosing a link shows the real address and stays on this page. The simulator does not fetch the address, follow a redirect, or download an attachment.
What should I inspect before I answer?
Read the sender address after the @ sign, then the real address under each link. Look for a file you did not ask for, a hurry, a prize, a request for a password, or a note that tells you to keep a secret. The display name is not the sender.
Does a perfect score mean I will catch a real phish?
No. This is practice on a fixed set of cues. A real message can be fake without these patterns, and a real company can send a deadline. When money or a password is involved, open the service from a bookmark you already trust.
Where does the best score live, and can I play again?
Play again shuffles the same fictional mailbox. Your best score stays in this browser only. Clearing site data for cyberscryb.com removes it. The round itself is forgotten when you leave or shuffle.