The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

Phishing analysis: headers, links, and attachments, safely

2026.04.04//8 MIN READemail-securityphishing-defenseincident-responsedigital-forensics

// Identifying Phishing Attempts

Phishing attempts can be deceptively sophisticated. They often impersonate legitimate entities, relying on social engineering to trick users into divulging sensitive information. An effective analysis starts with examining email headers, scrutinizing links, and analyzing attachments.

// Analyzing Email Headers

Email headers provide critical information about the path an email took from the sender to the recipient. To extract headers, use your email client or tools like curl. Here’s a command-line approach:

# Fetching an email's raw headers using curl
curl -s -u 'username:password' 'https://mail.example.com/api/v1/messages/1' | jq '.headers'

Replace username, password, and the URL with your credentials and email provider's API endpoint. The jq tool helps in parsing JSON output.

Common fields of interest include:

  • From: The sender's address.
  • Return-Path: Where undeliverable emails are sent.
  • Received: The servers that handled the email.
  • Message-ID: A unique identifier for the email.

Example Header Analysis

Here’s a fictional header snippet:

From: "Spoofed Sender" <spoofed@malicious.com>
Received: from mail.server.example (mail.server.example [192.0.2.1])
    by mx.example.com (Postfix)
    with ESMTP id 1234567890
    for <user@example.com>; Wed, 1 Jan 2023 12:00:00 +0000 (UTC)

In this example:

  • The From address is suspicious. Use WHOIS services to investigate the domain.
  • The Received field shows an unusual server IP. Look it up to determine its legitimacy.

// Scrutinizing Links

Phishing emails often contain links that appear legitimate but lead to malicious websites. To safely analyze these links without clicking them, extract URLs and test them in a controlled environment. Use tools like wget or curl to fetch the link contents without executing scripts:

# Fetch the URL content safely
wget --spider http://malicious-link.com

Using --spider ensures you only simulate the request without downloading anything. If you get a response like 200 OK, the link is live, but it doesn’t mean it’s safe.

Common Indicators of Malicious Links

  • URL Shorteners: Always suspicious. Use URL expanders.
  • Mismatched Domains: Hover over links to see the actual URL.
  • HTTPS vs HTTP: Legitimate sites typically use HTTPS.

// Inspecting Attachments

Attachments are common vectors for malware delivery. Before opening, analyze them with tools like file to determine the file type:

# Check the file type of an attachment
file suspicious_attachment.exe

Malware often disguises itself as benign file types. A .exe file should raise red flags if it’s sent in an email purportedly from a trusted source.

Common Mistakes to Avoid

  • Opening Attachments Directly: Always analyze files in a sandbox or virtual environment.
  • Ignoring Warning Signs: Pay attention to poor grammar or urgent requests for action.
  • Neglecting URL Checks: Always verify links before clicking.

// Defensive Implications

Understanding how to analyze phishing attempts can significantly bolster your defenses. Here are steps to implement immediately:

  • Train staff to recognize phishing attempts, focusing on header analysis.
  • Implement email filtering solutions that can flag suspicious emails.
  • Regularly update incident response plans to incorporate phishing scenarios.

// Quick Checklist for Phishing Analysis

1. Verify Email Headers: - Check the From and Received fields. - Look for discrepancies. 2. Analyze Links: - Use command-line tools to check links without clicking. - Hover over and verify URLs. 3. Inspect Attachments: - Use file command to check file types. - Analyze in a controlled environment.

// Conclusion

Phishing defenses require diligence and a methodical approach. By focusing on email headers, links, and attachments, you can better identify potential threats before they escalate. This technique is integral to securing your environment and should be practiced in a disposable lab range you own. Remember, the DaemonCore Academy curriculum is free, providing more avenues for honing your skills.