Phish Patrol Worksheet
Cyber Defense Lab Indiana CS 6-8.NC.2 • 6-8.IC.2
Phish Patrol: Threat Analysis
Name:
Date:
Period:
Investigator's Field Guide: 4 Core Red Flags Inspect sender, payload, urgency, and destination before clicking
Sender Mismatch
Display name looks real, but actual domain is misspelled or spoofed.
Artificial Urgency
Threatens immediate lockout or loss to trigger panic clicking.
Deceptive Links
Hovering shows destination URL leads to an unofficial domain.
Sensitive Asks
Solicits passwords, 2FA codes, gift cards, or personal records.
CASE FILE #01 Email Analysis • "School Portal Account Deletion Notice"
ID: SEC-2026-881
From: District IT Support admin-support@district9-portal-security.net
To: student.7824@middletown.k12.in.us
Subject: URGENT: Your Student Access Will Be Terminated in 3 Hours
Dear Student: Unauthorized login attempts were detected from outside Indiana. To prevent your school Google Drive, Canvas assignments, and transcript records from being permanently locked, you must confirm your credentials immediately.
[Click Here to Re-Authenticate Your School Account]
Hover Preview URL: http://login.verify-district-credentials.ru/k12-auth/portal.html
1. Security Verdict:
Legitimate / Safe Phishing / Fraudulent Needs Further Verification
Check exactly one box
2. Evidence & Red Flags: Cite at least two specific red flags from sender domain, URL, or message tone:
CASE FILE #02 Smishing (SMS) Analysis • "Indiana Tollway Fee"
ID: SEC-2026-904
+1 (555) 019-4822 Today • 2:41 PM
[IN-TOLL ALERT] Unpaid toll invoice detected for household vehicle ($4.50). Avoid a $75.00 late fee. Pay within 24 hours: https://bit.ly/in-toll-pay99
1. Security Verdict:
Legitimate / Safe Phishing / Fraudulent Needs Further Verification
Check exactly one box
2. Technical Justification & Action: Why is a shortened URL (bit.ly) hazardous, and how should an unpaid toll legitimately be verified?
Indiana Academic Standards for Computer Science • Grades 6-8 Network Communication & Impact Page 1 of 2 • Turn Over for Part II & Exit Ticket
Part II: Social Engineering & Strategic Analysis
Evaluating compromised accounts, psychological levers, and verification protocols
CYBER-INSPECTION LOG
CASE FILE #03 Compromised Friend Direct Message • Gaming Platform
ID: SEC-2026-955
Direct Message • User: @Marcus_Hoosier88 (Your actual classmate Marcus) Today • 4:18 PM
yo!! my esports team just qualified for the Indiana Middle School tournament finals but we need 1 more vote to get the sponsor prize. can u vote for us real quick? takes 5 sec: https://steamcommunity.valvesoftware.in-tournament-vote.com/login
it asks u to sign in with your Steam/Epic account so it knows you're not a bot. please hurry voting ends in 10 mins!
1. Security Verdict:
Legitimate / Safe Phishing / Fraudulent Needs Further Verification
Check exactly one box
2. Account Hijacking & Domain Breakdown: Why is a message from a real friend still unsafe here? Analyze the URL domain and Marcus's likely account status:
Investigative Synthesis: Attack Mechanics
Q1 (Psychology of Phishing): Why do cybercriminals rely on emotional triggers like fear (account shutdown), excitement (free prizes), or social pressure (helping a friend) rather than trying to hack firewalls directly?
Q2 (The "Out-of-Band" Rule): If you receive an urgent message from a friend, teacher, or company, explain how to verify it safely without replying to the message or clicking any embedded link.
Exit Ticket: Security Clearance Verification
Submit Before Leaving
Final Scenario: You receive an email from principal.miller@middletown-schools.org with subject "Student Council Schedule Revision" containing an attached file titled Schedule_Update.pdf.exe.
A. Identify the critical technical red flag:
B. What is your immediate protocol response?
Indiana Academic Standards for Computer Science • 6-8.NC.2 (Cybersecurity) • 6-8.IC.2 (Digital Communication Safety) Page 2 of 2 • Clearance Complete
