Lab: analysing a suspicious email safely (headers and links)

Aim and what you need

The aim is to decide, with evidence, whether an email is phishing, and to collect indicators (sender, domains, URLs, hashes) that can be blocked. You never open links or attachments; you study the message as text.

• A suspicious email from your own mailbox or spam folder, or a training sample. Do not use other people's mail without permission; messages contain personal data.
• A Linux VM in your isolated lab for handling the file.
• At work, follow your organisation's reporting process instead; the security team may want the original message untouched.

Method

Steps

1. Export the raw message. In Outlook use File, Save As (or View message source); in Gmail use Show original, Download original. Save it as sample.eml and copy it to the lab VM.
2. Read the key headers. Compare From, Reply-To and Return-Path. Read Received lines from the bottom up to trace the path.
3. Check authentication. Find the Authentication-Results header added by your provider and note the SPF, DKIM and DMARC results. Look up the sending domain's published records.
4. Extract links without opening them, then defang them (for example hxxps://login-example[.]com) before pasting into notes or tickets.
5. Handle attachments by hash only. Compute SHA-256 and check it against your organisation's threat intelligence. Do not upload files that might contain personal or company data to public services.
6. Write a verdict: phishing, spam or legitimate, with the evidence and recommended actions.

grep -i -E "^(from|reply-to|return-path|subject|date|message-id):" sample.eml
grep -i "^received:" sample.eml
grep -i -A3 "^authentication-results:" sample.eml
dig +short TXT example.com
dig +short TXT _dmarc.example.com
grep -o -E 'https?://[^ ">]+' sample.eml | sort -u
sed -e 's/http/hxxp/' -e 's/\./[.]/g' urls.txt
munpack -t sample.eml
sha256sum invoice.html

Encoded parts of the message (base64 or quoted-printable) can hide links. The munpack tool (from the mpack package) decodes attachments to files; small encoded strings can be checked with the Base64 tool and hashes compared with the hash tool.

Verify

Success means you can fill in a short report like this, and every field is backed by something you found in the file:

Troubleshooting and clean-up

• No Authentication-Results header: some clients strip headers when forwarding. Always export the original, never a forwarded copy.
• Links look garbled: they are encoded; decode the part first, or use your mail provider's message source view.
• Passes SPF and DKIM but still looks wrong: attackers often use their own correctly configured domains. Authentication proves who sent it, not that they are honest.
• You clicked a link by accident: report it at once; at work, follow the phishing incident process.

When finished, delete the sample and extracted files from the VM (or restore its snapshot), and keep only your defanged report. Training colleagues with real, anonymised examples from your own analysis is one of the most effective awareness activities.