One email. Eight checks.
Follow a fictional phishing case. No commands needed.
Case progress
0 of 8 completed- 1. Inspect
- 2. Investigate
- 3. Protect
- 4. Report
See all 8 steps
STEP 1 OF 8 · CLIENT
Read the email
Start with the message, not just its authentication result.
LAST RESULT
View the evidence
Behind this step: host & command
Runs on Client
cat inbox/001.emlUse ls, cd and cat, or switch hosts below. Your checks still update the progress above.
Open terminal & network Optional · explore the same case yourself
↑ history · Tab complete · help commands · No real connections or messages.
Case details & evidence
Case LAB-001
Not assessed- Original email
- Not yet retained
- Client DNS before
- Not queried
- Client DNS now
- Not queried
- Provider report
- Not sent
Network & supported commands
Client → mailserver → analyst → Pi-hole. The client uses 192.0.2.53 for DNS. The suspicious hostname is signin-check.example.
This is a small simulated shell, not a full Linux installation. Supported: help, ls, pwd, cd, cat, sha256sum for the sample email, ssh, exit, dig, nslookup, helpdesk, pihole, history, clear, reset. Pipes, writes and arbitrary executables are outside this demo.
State stays in this browser tab while using the site’s navigation. Reloading the page starts a fresh case. The provider and evidence are fictional; the deep dive explains the actual workflow.