Phishing email analysis

Hi Stewart, this is a wee Security Research Project im working on.
Where hostile mail
gets taken apart.

Messages arrive at Phishing Honeypots, get pulled apart header by header, and are written up one at a time — what the sender claimed, what the headers actually say, and how you'd catch it next time.

See a sampleFirst write-ups in progress

Header analysisExample only

From: "IT Service Desk" <no-reply@example-notabank.invalid>
Subject: Action required: sign-in verification

Fictional message, written for this page. The display name claims to be internal IT; every authentication check fails and both sender fields sit on the same lookalike domain.

Recent samples

Placeholder entries

SAMPLE-001Credential harvestlogin.example-notabank[.]invalidmalicious
SAMPLE-002Invoice fraudbilling.example-supplier[.]invalidmalicious
SAMPLE-003Delivery luretrack.example-courier[.]invalidsuspicious
SAMPLE-004Callback scamsupport.example-helpdesk[.]invalidinconclusive

Invented entries on reserved .invalid domains, defanged with brackets. Real catalogue to follow.

Method

Draft copy

Collection

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vestibulum tincidunt mauris eu risus varius, non fermentum arcu porta. Sed auctor lectus quis sapien vehicula.

Analysis

Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris.

Write-up

Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor lorem non nisi.

Tooling

Draft copy

Triage

Praesent commodo cursus magna, vel scelerisque nisl consectetur et. Aenean lacinia bibendum nulla sed consectetur.

Corpus

Vivamus sagittis lacus vel augue laoreet rutrum faucibus dolor auctor. Maecenas faucibus mollis interdum.

Detection

Donec ullamcorper nulla non metus auctor fringilla. Cras mattis consectetur purus sit amet fermentum.