Catch a Phish: Investigate a Suspicious Email

I triaged six suspicious emails from my own inbox. I wrote a first guess and a reason for each before checking anything, then went and got the proof, and two of my six calls changed. The output is a checklist I would use on any new email.

by@cobalt-zephyr-0796· built fromCatch a Phish: Investigate a Suspicious Emailtheir first build

Your notes on each email 1. The email: Two of my six first guesses changed once I checked. The bank alert I called sketchy was a real attack: the sender domain was a lookalike with a swapped letter. The friend request I called sketchy was 2. The email: Payroll asking you to confirm your bank details 3. The email: An invoice from a company nobody here recognises 4. The email: A shared document from a coworker who did not send it 5. The email: A marketing newsletter nobody ever signed up for 6. The email: The printer saying it scanned something for you

1 view

What's the sharpest choice they made? (one line, shows on this page)

Built across 1 day, 3 steps. See the record

How this was built

2026-09-06 to 2026-09-06 · built across 1 day · 3 steps completed

Calls they made along the way

"1. Fake IT password reset: real attack. The from name said our IT desk but the address was a gmail. 2. Package delivery text: sketchy. I never ordered anything and the link was a shortener. 3. School portal notice: harmless. It came from the real school domain and asked me to do nothing. 4. Job offer out of nowhere: real attack. It offered a lot of money for almost no work and wanted my bank details. 5. Bank alert: sketchy. Right logo, but it addressed me as Dear Customer. 6. Friend request that" · 2026-09-06
"Two of my six first guesses changed once I checked. The bank alert I called sketchy was actually a real attack: the sender domain was a lookalike with a swapped letter. The friend request I called sketchy was harmless, just a new account. The fake IT reset stayed a real attack and now I can prove it: the sending domain fails its own sender check and the button pointed at a different site than the text said." · 2026-09-06

Started from a first draft on 2026-09-06.
Asked for feedback 2 times before publishing.

This record was captured while the work happened, not written after. Evidence like this is high friction to fake.

Cybersecurity Analyst SOC Analyst Incident Responder Threat Intelligence Analyst Security Engineer

Catch a Phish: Investigate a Suspicious Email

How this was built

Want to try Catch a Phish: Investigate a Suspicious Email?