A guided, self-paced exercise. You will analyze sample phishing emails and their headers, then practise detection, triage, and response — exactly as a security team would.
Presenter: Petrache Carmen Anemona · UNSTPB
Sort a real inbox and spot the warning signs of a phishing email with the naked eye.
Read raw headers (SPF/DKIM/DMARC) and OSINT data to prove what the message really is.
Rate the severity and choose the correct first actions to contain the incident.
Each step opens with a short theory section, then a hands-on task. By the end you will be able to:
It is Saturday morning, Analyst. Three messages are waiting in a shared mailbox. First, decide which are safe and which are attacks — then dissect the worst one.
Phishing is a fraudulent message that impersonates a trusted sender to trick you into clicking a link, opening an attachment, revealing your password, or making a payment. It attacks the human layer, not the technology — which is why the vast majority of cyber incidents begin with a phishing email.
It works because it exploits mental shortcuts we all rely on:
synerg1a-hr.com is not synergia.ro.Phishing. Look-alike domain synerg1a-hr.com (a “1” for the “i”), manufactured urgency, and a link asking you to log in. Classic credential harvesting.
Legitimate. Correct internal domain synergia.ro, purely informational, no link, no credential request, no urgency. Don’t over-react to normal IT notices.
Phishing. Unofficial domain dhl-parcel-delivery.info, a tiny payment to harvest card details, and a 24-hour threat. Couriers don’t collect fees by email link.
Phishing — Business Email Compromise (BEC). No link, no malware — just a believable request. Tells: look-alike domain synergia-corp.net (not synergia.ro), a money move, secrecy (“keep this between us”), and urgency. Always verify payment changes by phone on a known number.
synerg1a-hr.com vs synergia.ro)Four real signals: the look-alike domain, the urgency, the threat, and the credential request. Not signals: fluent language and a missing logo — modern phishing is well-written and often copies branding perfectly.
synerg1a-hr.com — a digit “1” where the letter “i” should be. What technique is this?Typosquatting. The attacker registers a domain that reads almost the same (1↔i, rn↔m, or an extra word like “-hr”). A homograph attack is the close cousin that swaps in identical-looking Unicode characters. Your eye fills in what it expects — especially under time pressure.
Suppose you missed the signs and clicked the link. This is the page that opens — and what really happens behind it. It is a safe simulation — do not type real data.
Recognizing it is a hunch. Now prove it. The body can lie; the headers and public records carry the truth.
Every email carries hidden metadata called headers — think of them as the envelope, postmarks, and routing stamps on a physical letter. The body is what you read; the headers record how the message actually travelled, and they are much harder to fake.
You can see these yourself: Gmail → Show original; Outlook → File ▸ Properties ▸ Internet headers.
These three checks let a receiving server answer one question: is this really from the domain it claims?
fail = not authorised.none = no valid signature.p=reject = “reject impostors.”OSINT (Open-Source Intelligence) means investigating a domain, IP, or file using public records — without touching the attacker’s infrastructure.
An IOC (Indicator of Compromise) is a concrete artifact — a domain, IP, URL, or file hash — that you can block across the whole organisation so the next colleague is protected automatically.
spf=fail · dkim=none · dmarc=fail plus a Received hop from 185.220.101.47. What do they tell you?Forged sender. spf=fail = the sending IP isn’t authorized for the domain; dkim=none = no valid signature; dmarc=fail (p=reject) = the real domain owner says “reject impostors.” The Received line shows the true origin. Authentication results are among the strongest header signals.
Reply-To: hr-support@synerg1a-hr.com differs from the visible From. What does that let the attacker do?It hijacks the reply. A mismatched Reply-To is a classic BEC technique: the message looks like it’s from a trusted sender, but your answer is routed to the attacker — perfect for invoice-fraud back-and-forth.
synerg1a-hr.com185.220.101.47https://synerg1a-hr.com/portal/loginsynergia.roelena.marin@synergia.roBlock the domain, the IP, and the URL. Never block the real company domain or the victim — that punishes the wrong party. IOCs are pushed to the firewall/proxy/DNS so the next colleague is protected automatically.
Padlock ≠ trust. SSL/TLS protects the data in transit; it makes no claim about the owner. Most phishing pages today carry a perfectly valid free certificate. The padlock means “private,” not “safe.”
Update: a colleague, Elena, confirms she clicked the link and entered her password. Now you triage the incident and act.
Not everything is an emergency. Triage is the act of deciding, quickly, what an alert really is and how urgently to act.
Security teams follow a repeatable cycle so nothing is missed under pressure:
When you log in successfully, the server hands your browser a session token — a temporary pass that says “this person is already authenticated.” MFA protects the login; it does not protect the token.
In an Attacker-in-the-Middle (AiTM) attack, the fake page sits between you and the real site, relaying everything live. When you approve the MFA prompt, the attacker captures the post-MFA token and walks straight in — which is why revoking sessions is the critical response step.
An attack is a chain: Reconnaissance → Delivery → Exploitation → Installation → Command & Control → Actions on the objective (exfiltration). The attacker must succeed at every link; a defender only has to break one. The timeline further down shows our incident moving through these stages.
High / contain now. A confirmed credential entry is an active compromise, not a “maybe.” Triage decides priority and escalation — and the clock is already running. Waiting only widens the damage.
MFA is not magic. AiTM phishing proxies the real login in real time and captures the post-MFA session token. That’s why the rule is: only approve a prompt you yourself just triggered — and why revoking sessions is the key response step.
Revoke sessions, block the IOCs, report. A password reset alone is useless if the attacker already holds a live session — revoke it. Reinstalling the OS destroys evidence, mass-emailing causes panic, and “wait and see” hands the attacker more time.
Identify → Contain → Eradicate → Recover → Lessons learned. Confirm what happened, stop the bleeding first (revoke sessions, block IOCs, isolate), remove the foothold, restore safely, then write it up so detection improves. Containment always comes before clean-up.
Notify, monitor, learn. Deleting logs destroys evidence (and may be illegal); blaming the user guarantees the next person hides their mistake. A blameless review is what actually makes the organization safer.
When an email rushes you, slow down. Check the sender and the domain, letter by letter.
The headers and public records — SPF/DKIM/DMARC, WHOIS — carry the truth the body hides.
Fast and without shame. Reporting is the most valuable thing you can do — it protects everyone.
This page is a single, self-contained file — no install, no accounts, works offline in any browser. Take it back to your own team.