All about the Phishing Game Simulator

ph1sh.me is a phishing-awareness game dressed as a mail client. You sit a shift as a Conglomcorp analyst: genuine messages stay Safe, hostile ones go to Quarantine.

Each shift draws 10 messages from a pool of 50. Inspect the sender, hover links to see the real URL, and open headers when the rest is unclear. Wrong calls cost score. Miss enough phish and the shift ends.

Completely free to play. No account. Launch the simulator from Game when you are ready.

Goal

Create an engaging, hands-on way to practise spotting phishing emails. A realistic inbox lets you investigate messages the way you would at work — without the risk of a real click.

Reading about phishing helps. Doing the checks yourself is what sticks: sender, links, content, and headers, then a Safe or Quarantine call.

Technical details

The site is a static Astro app. The inbox itself is a React mail client, so the game can update live as mail arrives and you decide.

Key pieces:

• Astro — pages, wiki, and blog as a fast static site.
• React (@astrojs/react) — the simulator UI: inbox, message view, headers, and scoring.
• TypeScript — typed game state and email data.
• Tailwind CSS — the Aerion-inspired dark mail-client look.
• Zod — validates every message in the pool before it can appear in a shift.
• Markdown + YAML (gray-matter) — each email is content, not hardcoded UI. Headers live beside the body so SPF and routing can be inspected.
• DOMPurify — sanitises HTML bodies so realistic markup stays safe to render.
• Vitest and Playwright — unit tests for the engine and end-to-end coverage of a full shift.
• Cloudflare Workers — static hosting.

The pool is split evenly: 25 genuine, 25 hostile. Malicious mail must show a mismatched link and a failing SPF signal; safe mail must not.

Future developments

The first-shift overlay already names the queue, the message view, headers, and the Safe / Quarantine buttons. Work still ahead:

• Investigation tutorial — a step-by-step walkthrough of the interface that leads you through a thorough check, not only a first look at the layout.
• Richer email bodies — clearer, more convincing content so the feel of real mail keeps improving.
• A wider, harder pool — more variety and more complex messages to investigate.
• Difficulty profiles — Easy, Medium, and Hard, including time limits.
• Levels — longer play than a single ten-message shift.

The wiki covers how a shift works today. Launch the simulator from Game when you are ready to investigate.