Project 19: Phishing Indicator Recognition Lab

Module: Module 2: OSINT, Social-Engineering Awareness & Traffic Analysis  |  Level: Beginner  | 
Primary tool: Google’s Phishing Quiz + PhishTank (read-only)  |  Estimated time: 45–75 minutes

Objective: Learn to identify credential-harvesting page indicators without building or hosting any deceptive page.

Free lab environment

OSINT Framework + theHarvester + Shodan (free tier) — https://osintframework.com/ and https://www.shodan.io/

Practice OSINT techniques against your own domain, your own social media presence, or explicitly-designed OSINT training targets (e.g. TryHackMe’s free OSINT rooms). Shodan’s free tier gives limited but real query results without payment. Never aggregate data on a real private individual without their consent as a course exercise.

Lab workflow

1. Confirm your target is a domain/account you own, or an explicitly-provided training target — never aggregate data about a real private individual without consent as a course exercise.
2. Using Google’s Phishing Quiz + PhishTank (read-only), run your collection step to learn to identify credential-harvesting page indicators without building or hosting any deceptive page.
3. Organize every raw finding into a simple table: what was found, where, and why it matters.
4. Rank your findings by real-world sensitivity — not every piece of public information is equally risky if combined with other data.
5. Write a one-paragraph remediation note for the single most sensitive finding.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• a screenshot of a PhishTank example with the mismatched-URL/certificate indicator you spotted circled or annotated
• your written checklist of 5 indicators a user should check before entering a password

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.