Cyberstudy
Supplementary — not from your PDF Beginner ~25 min

Inspect a suspicious email safely

Read the headers of a spam or phishing message already sitting in your own mailbox and spot the warning signs, without clicking anything.

Environment

Your own email account in a web browser (most webmail has a 'Show original' or 'View message source' option).

Before you start

  • Read Phishing and Pharming (p.44), Typosquatting (p.46) and Business Email Compromise (p.47).

You will

  • Find the real sender behind the display name
  • Read SPF, DKIM and DMARC results in the headers
  • List the social engineering cues in the message

Steps

  1. 1

    Open your spam or junk folder and pick a message that looks like phishing. Don't open attachments or click links.

  2. 2

    Open the full headers with 'Show original' or 'View source'.

  3. 3

    Compare the display name with the actual address in the From: header, and compare that with Return-Path: and Reply-To:.

  4. 4

    Find the Authentication-Results: header and note whether spf=, dkim= and dmarc= say pass, fail or none.

  5. 5

    Hover over (don't click) any link and compare the real destination with the text shown. Look for lookalike domains like the ones on p.46.

  6. 6

    List the persuasion techniques used: urgency, authority, fear, reward. Match them to Impersonation and Pretexting (p.43).

  7. 7

    Report the message with your provider's 'Report phishing' button, then delete it.

Check your understanding

  • ?What does a DMARC failure tell a receiving mail server?
  • ?Why can't you trust the display name?
  • ?Which of the guide's phishing types does your example fit best?