analyzing-phishing-emails

Analyzing Phishing Emails

An email is a stack of claims — who sent it, where it came from, that its links are safe — and phishing analysis is checking each claim against evidence the sender could not forge: the Received chain, the authentication results, and the true destination of every link and attachment. The From header is a display, not a fact. Anyone can type any address into it; your job is to find the evidence that agrees or disagrees.

When to Use

• A user reports a suspicious email and you need a verdict and IOCs
• You have a .eml or .msg file to analyze offline
• You are handed raw headers and asked whether a message is spoofed
• A message carries a link or attachment that needs safe triage
• A business email compromise, invoice-fraud, or vendor-impersonation case
• Confirming whether a domain or brand was spoofed against your users

When NOT to Use

• You extracted an attachment and need to detonate it — come here first to safely extract and defang it, then hand the payload to analyzing-malware
• The phish already succeeded and you are chasing the mailbox/OAuth compromise in the tenant — use investigating-m365-entra
• You are building the phishing campaign, not analyzing one — use performing-social-engineering
• The broader incident the phish kicked off — use responding-to-incidents
• Analyzing the callback traffic from a detonated payload — use analyzing-network-traffic

Safe Handling — Do This First

Treat every reported message as live. The failure mode is not misreading a header; it is clicking a link in a production mail client or double-clicking an attachment on your own host.

• Never open the message in a live client. Attacker-controlled remote images fire a read beacon; one click on a link authenticates you to their harvester.
• Work from the raw source only — the .eml/.msg, not a forwarded copy. Forwarding rewrites headers and strips the evidence you need.
• Defang every indicator before it touches a report, ticket, or chat: http → hxxp, . → [.], @ → [at]. So http://evil.com/login becomes hxxp://evil[.]com/login. Defanging prevents an accidental click downstream and stops link-preview bots from detonating it for you.
• Extract and detonate only in an isolated VM with no host sharing and simulated or monitored egress — see analyzing-malware for the build.