{"id":54665,"date":"2022-08-03T09:26:39","date_gmt":"2022-08-03T01:26:39","guid":{"rendered":"https:\/\/version-2.com\/?p=54665"},"modified":"2022-08-19T15:16:55","modified_gmt":"2022-08-19T07:16:55","slug":"gone-phishing-email-header-and-body-analysis","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/08\/gone-phishing-email-header-and-body-analysis\/","title":{"rendered":"Gone Phishing – Email Header and Body Analysis"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>\n

Intro<\/h3>

In this article, I will investigate how you can analyse an email, and confirm if it\u2019s a phishing\/scam\/spam email. The idea here is to look at some tools that you might use for this, as well as how to open the attached file, that is most likely malicious, in a safe (sandboxed) way so you can learn what it does. Unfortunately, my example doesn\u2019t contain an attachment, but I will look into that anyway.  <\/p>

With that being said, let\u2019s dive into it!<\/p>

Email Headers<\/h3>

Now that we know how an email travels, let\u2019s look more closely at the components that make up the said email. This is more of a manual approach, but my rationale behind is that we should first understand what we need to do here, before using any specific tooling. You should be able to analyze the suspicious email manually \u2013 I don\u2019t see how you would do so with a tool without understanding what\u2019s going on first.<\/p>

So! We have:<\/p>

The Header<\/strong> (which contains information about the email \u2013 for example, which servers relayed the email)<\/p>

The Body<\/strong> (which is the email\u2019s text, usually HTML formatted but it can be in regular plaintext)<\/p>

Let\u2019s look at email header fields:<\/p>