Phishing Track · Part 3 of 3

Don’t just delete the email. Trace it.

The TRACE method, for people without a tech background: preserve the evidence, reveal the real sender, read what the headers actually say, check where the link really lands, and report it so the whole campaign dies — not just your copy.

Start the course Free · No signup Browse the curriculum ↓
  • Time~4 hrs
  • LevelAdvanced
  • FormatHands-on labs
  • FinishCertificate

The brief

What you'll walk away with

  1. 01The forensic mindset

    Think evidence-first: what to preserve, what to never touch, and why it matters.

  2. 02Take a snapshot

    Preserve suspicious messages without destroying the evidence most people delete.

  3. 03Reveal the real

    Find the “View Original” button every client hides, and the three header lines that matter.

  4. 04Authenticate the sender

    SPF, DKIM, and DMARC as one plain question: pass, fail, or missing?

  5. 05Check the landing

    Follow a link safely — homographs, redirects, sandboxes — without ever clicking it.

  6. 06Escalate

    Report so IT, APWG, brands, and law enforcement can actually stop the campaign.

“You can’t always spot a fake. But you can always preserve the evidence, read what a message actually carries, and report it in a way that protects thousands of other people.”

Curriculum

Six modules, then the exam

6 modules · 18 lessons · ~4 hrs

1

The Forensic Mindset

35 min 3 lessons + quiz
Why Investigate at All? 10 min What You Can't See vs. What You Can 10 min Introducing TRACE 10 min Module 1 Quiz 5 min
2

Take a Snapshot (T)

35 min 3 lessons + quiz
The Delete Mistake 10 min Screenshots Done Right 10 min Forward-as-Attachment 12 min Module 2 Quiz 5 min
3

Reveal the Real Sender (R + A)

50 min 4 lessons + quiz
"View Original" — The Button Nobody Uses 12 min Three Lines Worth Reading 15 min Did It Actually Come From Them? 12 min When Authentication Lies 10 min Module 3 Quiz 5 min
4

Check the Landing (C)

40 min 3 lessons + quiz
Hover, Copy, Never Click 10 min Where Does This Link Really Go? 15 min Let a Robot Click for You 12 min Module 4 Quiz 5 min
5

Escalate (E)

35 min 3 lessons + quiz
Who to Tell 10 min Writing a Report That Helps 12 min The Ripple 10 min Module 5 Quiz 5 min

Final Assessment

10 min Certificate upon passing
Final Assessment 10 min Certificate & Completion 5 min

Who it's for

Evidence handlers

Security champions

You’ve finished the first two courses and want to contribute evidence, not just avoid attacks.

Team leads & managers

You receive phishing reports from your team and want to respond with the right next step.

The curious

You want to know what happens after you hit “Report” — and how to make it matter.

Close the loop

Make your reports matter.

Four hours from “this looks suspicious” to evidence a security team can act on. Free, certificate at the end.

Begin Module 1