phishing forensics, read headers before you click

the email is a crime scene, stop clicking on it

everyone's first instinct with a sketchy email is to click the link "just to see." don't. that's like walking into a crime scene and licking the doorknob to see if it tastes like evidence. the email itself is the evidence. it's got a full paper trail baked into it, you just have to know where to look. here's how to actually read a phishing email like a forensic analyst instead of a victim.

read the received headers bottom-up

every email has a stack of "received" headers that show every mail server it bounced through on the way to your inbox. most people never see these because your email client hides them by default. in gmail it's the three dots menu then "show original." in outlook it's file, properties, internet headers.

the trick is you read them bottom-up, not top-down. the bottom entry is closest to the true origin, the top entry is the last hop before it hit your inbox. each hop should be a server that plausibly handles mail for that sender's domain. what you're hunting for is a mismatch, like a "from" address claiming to be your bank but the origin hop is some random residential ip block or a server in a country your bank has never touched. that mismatch is the whole story right there.

spf, dkim, dmarc, the fail is the tell

these three are authentication checks that legit mail servers run automatically, and the results usually get stamped right into the header as "authentication-results."

spf checks if the sending server is actually authorized to send mail for that domain. dkim checks a cryptographic signature to confirm the message wasn't tampered with in transit. dmarc ties both of those together and tells receiving servers what to do if they fail, quarantine it or reject it outright.

if you see spf=fail, dkim=fail, or dmarc=fail on an email claiming to be from a company that clearly has their security together, that's spoofing, plain and simple. a legit sender passes all three almost every time. this one check alone kills most phishing attempts before you even open the body of the email.

detonate urls in a sandbox, never in your browser

if there's a link in the email, do not click it in your normal browser on your normal machine. that link could fingerprint your device, drop a payload, or just confirm to the attacker that your address is "live" and worth targeting again.

instead, extract the raw url from the html source of the email and run it through a sandbox tool built for this exact job. urlscan.io and any.run let you detonate a url in an isolated environment and watch what it actually does, what it redirects to, what it tries to download, without touching your real system. these tools screenshot the final page, log every network request, and flag known malicious infrastructure. it's the difference between defusing a bomb in a blast chamber versus your kitchen table.

hash the attachment before you even think about opening it

if the email has an attachment, don't open it to "check." generate a hash of the file instead, either sha256 or md5, using a simple command line tool.

sha256sum suspicious_invoice.pdf

that gives you a unique fingerprint for the file without executing anything. take that hash and paste it into virustotal. if dozens of antivirus engines flag it, you've got your answer without ever opening a single byte of the actual file. if it comes back clean, that doesn't mean it's safe, some malware is new enough to slip past detection, but it's still a fast first filter that costs you zero risk.

the takeaway

phishing emails aren't a mystery once you know where the evidence lives. the headers show you where it really came from, spf/dkim/dmarc tell you if it's spoofed, sandboxes let you see what a link does without risking your machine, and hashing lets you check attachments without opening them. none of this requires expensive tools, most of it is free and built into your everyday email client plus a couple of browser tabs. next time something lands in your inbox that feels off, don't click it, investigate it. that habit alone will keep you out of most of the traps sitting in your spam folder right now.