Catch a Phish: Investigate a Suspicious Email
Maps to: Cybersecurity Analyst · SOC Analyst · Incident Responder · Threat Intelligence Analyst · Security Engineer
Make a system for spotting scam emails.
You leave with a list of signs that an email is a scam. It shows you can tell a fake email from a real one.
Ever gotten an email that felt a little off, like something wasn't right about it? This project is that feeling, but done for real. Renata runs the computers at a small company, and her staff reported six emails last week that might be trying to trick or steal from someone. You figure out which ones are dangerous and which ones are safe. This is the actual first job in cybersecurity, the work of keeping computers and accounts safe from people trying to break in or trick people. You read each email first and guess. Then you read what the checks found: where each email really came from (every email carries a hidden trail that shows this, even when the name on top is faked), whether the sender has written before, where each link really goes, and what each file is, all without anyone clicking anything risky. Then you decide on the one the proof does not settle: warn everyone, or let it go. You walk away with a checklist you can reuse on any new odd email, and a short written report explaining what you found and why. One honest note: this is the defending side, stopping attacks, not the movie version where you break into things. Defending is most of what these jobs actually are, and it's not the boring version.
How this shows up on a resume or college app
I investigated six reported emails the way an entry-level security analyst does, reading where each one really came from, where its links led and what its files were, to separate real phishing attacks from false alarms. I made a call on the one the evidence could not settle, built a reusable checklist and wrote an investigation report. I learned that most of cybersecurity is patient, careful evidence-gathering, and that the hard part is making a call you can defend when the evidence is incomplete.
When you finish you have the thing itself, plus a Common App activity description Sidequest drafts from what you actually built.
Not sure yet? Play 5 minutes as a cybersecurity analyst first and see how the work feels.
See what this career pays and what it takes to get in.
The plan
- 1
Step 1
Read it first: decide before you check anything
Renata's staff reported six emails last week. Read them the way the person who sent each one hopes you won't: closely. For each one, write a one-line first guess before you think too hard about it: does it look like a real attack, does it look a little sketchy, or does it look harmless? Also write down the one detail that first made you suspicious. You'll be wrong about some of them, and that's the whole point: this first guess is what you test with real proof next.
- 2
Step 2
Get the proof: who really sent this
Now you move from 'this feels off' to 'here's the proof.' This is the slow, careful part, and it's most of the real work people in this job do. Every email carries hidden information you can't see just by reading it, kind of like a shipping label on the back of a package, and it shows where the email really came from. The checks have already run on all six: who really sent each one and whether they have written before, where each link really goes, and what each file is. Nobody clicked a link or opened a file to find out. Your job is to read the results and write down what they prove.
- 3
Step 3
Decide on the hardest email, then write your checklist
Most of the six are clear by now. One is not: the invoice from Brightline really came from Brightline, but its link asks you to sign in on a web address made three weeks ago, and no list has seen it. That's the real job: making a decision you can defend even when you're not fully sure, warn everyone or let it go. You decide first. Then Renata, who has to act on your answer, pushes back on it before you give your final answer on all six.
Go further
What counts: A short report with your checklist, on its own page, read by Renata.
- 4
Step 4
Write it up, and see what it says about you
People in this job live and die by the written report: writing it up clearly is half the work. Put the proof you read and the decisions you made into one short report for Renata's staff, people who are not into computers. It sits on your project's own page, with a link you can show anyone. Then you choose one part, and Renata asks you a hard question about it.