How To: Play the ph1sh.me Phishing Simulator

In short. You are a Conglomcorp Anti-Phishing analyst. Inspect incoming mail and mark it Safe or Quarantine. Later shifts add a DDoS drill and an attachment (Email IED) queue.

Safe or Quarantine

• Safe — the message is genuine. Leave it in the mailbox.
• Quarantine — the message is hostile. Pull it out of circulation.

Wrong calls cost score. Miss enough phish and the shift ends. A clean first shift earns a little extra lunch.

Level 3 — attachments

On the Email IED shift you also get Report Malware. Open files only when you trust them.

• Malware often hides behind a double extension (.pdf.exe, .csv.ps1) or as .exe, .bat, .ps1, .xlsx, .pptx, or .docx.
• Reporting a real payload scores points. Reporting a clean file, or a message with no attachment, costs points.
• Script payloads (.exe, .bat, .ps1) run as soon as you open them. Office files (.xlsx, .pptx, .docx) only detonate if you click Enable Macros.
• Opening a payload ends the shift. Skip jumps to the fired screen.

What to inspect

• Sender — the address, not just the display name.
• Links — tap or hover to see the real URL. Visible text can lie.
• Headers — SPF and routing when the rest is unclear.
• Attachments — the full filename, including anything after the first dot.

The first-shift tutorial walks through sender, links, and headers on the first two messages.