Inspect before you follow
Which action prevents exposure without discarding a legitimate notice?
Start with a concrete question
Inspect three complete fictional message excerpts against a known official destination.
Try the initial inputs, then write a prediction before changing one setting. All calculations run locally on your CPU.
What do you expect?
Before changing a setting: Which action prevents exposure without discarding a legitimate notice? Write what you expect and why.
Change one thing. Inspect what happens.
- Read the destination, request and context in the trace.
- Predict the consequence of following each message.
- Compare independent verification with discarding everything.
- Draft a short verification checklist and test a fresh invented message.
Your settingsMechanism
Calculation belowEvidence
Compare outcomes
Follow the calculation
- From club-help.example: “Your club password expires today. Sign in at club-reset.example.” The approved club domain is club.example.
- You follow the message and supply the requested credential or script permission.
- Fixture ground truth: this request is malicious.
Urgency or a familiar display name alone cannot establish authenticity. Compare the destination and independently verify unexpected requests.
Captures keep your inputs, prediction and observation. Results are recalculated from those inputs. Resetting inputs keeps your captures and challenge history.
Explain the mechanism
Inspect before you follow
Inspect three complete fictional message excerpts against a known official destination.
Follow the mechanism
A message can borrow familiar names while sending you to another destination.
The fixture makes ground truth visible after your decision so you can inspect consequences.
Independent verification uses a known channel, not contact details supplied by the suspicious request.
Worked example
From club-help.example: “Your club password expires today. Sign in at club-reset.example.” The approved club domain is club.example.
You follow the message and supply the requested credential or script permission.
Fixture ground truth: this request is malicious.
Calculation
Unauthorized exposure = dangerous request AND follow-request action.
Try a controlled comparison
Read the destination, request and context in the trace.
Predict the consequence of following each message.
Compare independent verification with discarding everything.
Draft a short verification checklist and test a fresh invented message.
What this does not establish
- All messages, people, documents and outcomes here are original fictional teaching fixtures; results are not measurements of real organizations.
Try a fresh case
Of 8 suspicious messages, 3 are legitimate. Discarding all eight loses how many legitimate messages?
This is a public practice check. Retries support learning; matching a number does not certify independent proficiency.
Take the investigation further
Choose any extension. These are project prompts for you to carry out; they are not automatically assessed.
School investigation
Create a new case with different numbers and explain your decision to a classmate.
College investigation
Implement or analyze a fresh case, document assumptions and compare at least two alternatives.
Workplace investigation
Prepare a decision artifact with evidence, operating constraints, an owner and a follow-up measurement.
Keep the evidence, choose your next step
Completion records your own decision that you have worked through this investigation. Practice checks and independent project evidence are separate.