Playing
How To: Play the ph1sh.me Phishing Simulator
Updated 17 August 2026
In short. You are a Conglomcorp Anti-Phishing analyst. Each shift, inspect incoming mail and mark it Safe or Quarantine.
Safe or Quarantine
- Safe — the message is genuine. Leave it in the mailbox.
- Quarantine — the message is hostile. Pull it out of circulation.
Wrong calls cost score. Miss enough phish and the shift ends. A clean run earns a little extra lunch.
What to inspect
- Sender — the address, not just the display name.
- Links — tap or hover to see the real URL. Visible text can lie.
- Headers — SPF and routing when the rest is unclear.
The first-shift tutorial walks through the same checks on the first two messages.