ForenShield Lab · Phishing Lab
Lead the investigation into suspicious e-mails
Some messages are traps, others perfectly legitimate despite appearances. Examine the headers, collect the indicators and give your verdict.
- ≈ 12 min
- No account
- Fictional data
Outline
What you will do
Examine the sender
Display name, real address, reply-to address: they do not all say the same thing.
Read the headers
Interpret the SPF, DKIM and DMARC results, and their limits.
Extract the indicators
Domains, IP addresses, links and attachments to block or check.
Give a verdict
Malicious or legitimate: each clue is then explained.
Key takeaways
What you will learn
- Tell the display name from the real address
- Understand what SPF, DKIM and DMARC prove, and what they do not
- Extract useful indicators (IOCs)
- Avoid wrongly flagging a legitimate message
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Are the brands and addresses real?
No. The companies, domains and addresses are made up, and the links lead nowhere. To analyze a real message, drop its .eml file into the site’s e-mail analyzer.
Is a message that passes SPF and DKIM safe?
Not necessarily. These checks show that the domain authorized the sending, not that the domain is honest: an attacker can properly configure a lookalike domain. Several messages in the exercise illustrate this.
Is this exercise suitable for beginners?
Yes. The first messages are accessible and each clue is explained. The later ones require reading the technical headers.