Free · no sign-up

Phishing simulator: would you have fallen for it?

Attacks on companies almost always start with a message like these. Two minutes, no sign-up.

Look at each message as you would on your phone and decide: legitimate or fraud? At the end you get your score and the clues that gave each one away.

1 · email

Bancolombia <alerts@bancolombia-security.co-verify.com>

Your account will be blocked in 24 hours

We detected unusual activity. To avoid the block, verify your identity now: http://bancolombia-security.co-verify.com/validate

Clues:
  • The real domain is co-verify.com, not bancolombia.com.co.
  • Urgency and a blocking threat.
  • Unencrypted http link.

2 · whatsapp

+1 300 555 0199 · “Management”

Hi, I'm in a meeting and can't talk. I need you to buy 3 gift cards of $200 and send me the codes here, it's urgent. I'll reimburse you later.

Clues:
  • Unknown number claiming to be the boss.
  • Asks for gift cards and codes: classic CEO fraud.
  • Urgency and “can't talk” so you don't confirm through another channel.

3 · email

T.I. RESCUE Support <support@tirescue.com.co>

Reminder: scheduled maintenance Thursday 8:00 a.m.

As agreed in ticket #4821, on Thursday we will do the file server maintenance between 8:00 and 9:00 a.m. If you need to reschedule, reply to this email or call us at the usual number.

Clues:
  • Refers to a ticket and a prior agreement.
  • Asks for no data and has no “verify” links.
  • Correct domain of a known provider.

4 · sms

Tax Office

Tax Office: you have a refund of $1,250 pending. Claim it within 48 h at https://tax-refunds.xyz

Clues:
  • Tax authorities do not notify refunds by SMS with a link.
  • .xyz domain that is not the official one.
  • Easy money with a short deadline.

5 · email

Google <no-reply@accounts.google.com>

Security alert: new sign-in on Windows

Your account was signed in from a new Windows device. If this was you, you don't need to do anything. If you don't recognize it, review your account activity at myaccount.google.com.

Clues:
  • Google's real domain.
  • No urgency or threat.
  • Points you to the site by name, not a strange link. (Still: go there yourself, not from the email.)

6 · whatsapp

“WhatsApp Support”

Hello, this is WhatsApp support. You will receive a 6-digit code by SMS; send it to us to verify your account was not cloned.

Clues:
  • WhatsApp never chats with you asking for codes.
  • That code is the registration code: with it they take your account.
  • Never share codes that arrive by SMS.

🔒 Everything runs in your browser or is discarded after the response. We do not store what you type.

Want a full review of your company?

These tools show what is visible from the outside. A T.I. RESCUE pentest or audit covers the rest: systems, people and processes.

Talk to a specialist

More tools

Password generator and strength checker

Generate a strong password in one click, or type yours to see how long it would hold. Nothing leaves your browser.

Try it →

Was I hacked? Guided check

Tick what is happening to you. At the end you get the risk level and the steps in order, based on your answers.

Try it →

Domain security checker

Passive checks only (DNS, TLS and HTTP headers), the same ones any mail server or browser performs. Graded A to F.

Try it →

What is my IP?

This is the address your connection uses on the internet, and what a site sees when you visit.

Try it →

ISO 27001 self-assessment

Answer about what exists and works today, not what is planned. It is the short version of the GAP assessment we run with our clients.

Try it →

RTO, RPO and downtime cost calculator

Enter your numbers: the result is the cost of your last outage and the targets a continuity plan should set.

Try it →

Help desk cost per ticket

With five numbers you already have, you will know whether your support is expensive, overloaded or both.

Try it →

CVSS 3.1 calculator

Pick each metric and see the score instantly. The same formula we use in our pentest reports.

Try it →

IPv4 subnet calculator

Enter an IP and its prefix. You can also split the network into equal subnets for VLANs or segmentation.

Try it →

Cloud speed test

Not your ISP's test: it measures the real path to a server in Europe, like when you use Microsoft 365, a VPN or a cloud system. Close downloads and video calls before measuring.

Try it →

Email header analyzer

Ideal for that email “from the boss” or “from the bank” that doesn't add up. Everything is analyzed in your browser.

Try it →

DNS, MX and blacklist lookup

The tool we use when “the email never arrives”: it shows what other servers see of your domain and why they might reject it.

Try it →

SSL/TLS certificate checker

An expired certificate takes down your website, email and your customers' trust the same day. Check it in seconds.

Try it →