And in some accents you may get a full glottal stop where the /d/ and /t/ go. Those letters can get real crazy pronunciations depending on accent.

Latter and ladder are homophones in most of American english

In the gmail web client, I dont see an option to filter off headers. thunderbird lets you set up filters for custom headers, but it’s a bit more complicated.

TBH, i never used it to set up a custom filter, I just knew there were indicators I could use to figure out if an email was in fact a test

Apparently I’m both right and wrong.

At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:

X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validation

Apparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.

But also, they set an X-PHISHTEST header. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.

But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.

KnowBe4 includes a bunch of headers in the email, including a disclosure saying they have permission to run the simulated phishing test.