| name | analyzing-email-headers-for-phishing-investigation |
| description | Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation. Use when working with analyzing email headers for phishing investigation. |
| domain | cybersecurity |
| tags | ["forensics","email-analysis","phishing","spf","dkim","dmarc","header-analysis"] |
| subdomain | digital-forensics |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| atlas_techniques | ["AML.T0052"] |
| nist_csf | ["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"] |
Analyzing Email Headers For Phishing Investigation
Overview
Cybersecurity skill for analyzing email headers for phishing investigation. Follows industry best practices and security standards.
When to Use
Trigger phrases:
-
"analyzing email headers for phishing investigation"
-
"Parse and analyze email headers to trace the origin of phishing emails, verify s"
-
When investigating a suspected phishing email to determine its true origin
-
For verifying sender authenticity and detecting email spoofing
-
During incident response when a user has clicked a phishing link
-
When tracing the delivery path and relay servers of a suspicious email
-
For validating SPF, DKIM, and DMARC alignment to identify forgery
When NOT to Use
- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope
Prerequisites
- Raw email headers from the suspicious message (EML or MSG format)
- Understanding of SMTP protocol and email header fields
- Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification
- Email header analysis tools (MHA, emailheaders.net concepts)
- Python with email parsing libraries for automated analysis
- Access to threat intelligence platforms for IP/domain reputation
Workflow
import re
IOC_PATTERNS = {
"ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
"domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
"hash_md5": r"\b[a-f0-9]{32}\b",
"hash_sha256": r"\b[a-f0-9]{64}\b",
}
def extract_iocs(text: str) -> dict:
return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
