Inspect a suspicious email safely
Read the headers of a spam or phishing message already sitting in your own mailbox and spot the warning signs, without clicking anything.
Environment
Your own email account in a web browser (most webmail has a 'Show original' or 'View message source' option).
Before you start
- Read Phishing and Pharming (p.44), Typosquatting (p.46) and Business Email Compromise (p.47).
You will
- Find the real sender behind the display name
- Read SPF, DKIM and DMARC results in the headers
- List the social engineering cues in the message
Steps
-
1
Open your spam or junk folder and pick a message that looks like phishing. Don't open attachments or click links.
-
2
Open the full headers with 'Show original' or 'View source'.
-
3
Compare the display name with the actual address in the
From:header, and compare that withReturn-Path:andReply-To:. -
4
Find the
Authentication-Results:header and note whetherspf=,dkim=anddmarc=say pass, fail or none. -
5
Hover over (don't click) any link and compare the real destination with the text shown. Look for lookalike domains like the ones on p.46.
-
6
List the persuasion techniques used: urgency, authority, fear, reward. Match them to Impersonation and Pretexting (p.43).
-
7
Report the message with your provider's 'Report phishing' button, then delete it.
Check your understanding
- ?What does a DMARC failure tell a receiving mail server?
- ?Why can't you trust the display name?
- ?Which of the guide's phishing types does your example fit best?