Phishing Investigation & Email Threat Analysis

Curriculum

About this path

Most phishing reports are not attacks. A sign-in notice from a real service, a supplier moving its invoices to a new platform, a newsletter somebody forgot they subscribed to. The queue is full of mail that looks wrong and is fine. This path treats "not malicious" as a verdict you have to earn, with the mundane explanation named and the evidence pointed at, and it treats the reflex escalation as a cost rather than as the safe choice. Everything else in it is about the reports that are attacks, and about how far behind one message the work actually goes.

Every lesson hands you an artefact and asks for a decision. A header block, a URL, a gateway log extract, a takedown file. The order follows a real investigation. You collect before you change anything, read the message as evidence rather than as content, decide what the authentication results can and cannot settle, follow the link to the page and the kit behind it, scope the campaign across every mailbox it reached, and then run the response.

The first section covers the anatomy of a phishing message, how operators and phishing-as-a-service suppliers run a campaign, the targeting behind spear phishing, whaling, business email compromise and thread hijacking, and the triage decisions an analyst makes in the first five minutes. The second section is email as evidence: the envelope against the header, what each address field proves, the Received chain read from the bottom up, HTML bodies and attachments you should never open, and preserving the .eml with hashes and custody. It closes on SPF, DKIM and DMARC, and on why a message that passes all three can still be hostile.

The third section is the technical investigation. You read a URL before it resolves, recognise lookalike domains, find where a credential capture page sends what it collects, scope the campaign from gateway logs, and hunt a brand's lookalike domains through permutation, certificate transparency, urlscan and DNS pivots. The fourth section is the response. On the victim side you size the blast radius, choose containment by what each step costs and recover accounts after a session has already been stolen. On the brand side you build a takedown package a registrar or host will act on, and check that the page stays down.

Five missions run alongside the lessons. You triage a morning of reports and find the one that is not an attack, decide four messages whose authentication results cannot settle the verdict on their own, and work a supplier invoice that passes SPF and DKIM. In the capstone, Operation False Invoice, you fetch a capture page off the lab range, read the records behind its domains and run the response across a closed forum and a breach corpus. Between them, the Phishing Triage simulator asks for ten correct verdicts on a bank of real-looking mail, legitimate messages included.

There is no formal prerequisite. You should be comfortable reading raw text, a header block, a log line or a fragment of HTML, without a tool interpreting it for you. Cyber Threat Intelligence is a good path to take first. The graded work needs no vendor account or API key. The capture pages the missions send you to sit on the CTI Academy lab range, reached over the VPN configuration from Lab Access, and where a lesson works on real phishing domains it does so through public records such as certificate logs, DNS and urlscan rather than by opening the pages.

What you will learn

• Triage a reported message in the first five minutes. Decide what to open first, collect the evidence before anything changes it, and close, escalate or monitor with a reason you can write down.
• Call a benign message benign. Recognise the weird but legitimate mail every queue is full of, and defend a not malicious verdict instead of escalating by reflex.
• Read an email as evidence. Separate the envelope from the header, say what each address field actually proves, and read the Received chain from the bottom up to the first hop you can trust.
• Know what SPF, DKIM and DMARC actually settle. Read each authentication result for what it binds, spot a pass that proves nothing about the visible sender, and handle mail that authenticates and is still hostile.
• Take a phishing page apart without opening it. Read a URL before it resolves, recognise lookalike and brand-impersonating domains, and find where a credential capture page sends what it collects, including targets built at runtime.
• Use a phishing kit for what it is worth. Cluster campaigns and write detections from kit signatures and page artifacts, without mistaking the toolmaker's tag for the operator.
• Scope the campaign behind one message. Use gateway and mail logs to find every mailbox it reached, the earlier reconnaissance messages nobody reported, and the artefacts that will still be useful next week.
• Hunt lookalike domains before they are used. Combine permutation engines, certificate transparency, urlscan page artifacts and DNS pivots to find a brand's lookalikes and the infrastructure they share.
• Run the victim-side response in the right order. Size the blast radius from received to signed in, weigh what each containment step costs, and recover an account after a session has already been stolen.
• Get a phishing site taken down. Build a takedown package a registrar or host will act on, choose the right escalation path, and verify the page is gone and stays gone.

Who this path is for

• SOC analysts who work a reported-phishing queue and want a method behind the verdict, not another checklist of red flags.
• Incident responders who take over once credentials have been submitted and need to scope the campaign and contain it in the right order.
• Brand protection, fraud and threat intelligence analysts whose organisation's name keeps turning up on lookalike domains and credential capture pages.
• Anyone who has finished Cyber Threat Intelligence or Cybersecurity Foundations and wants a hands-on investigation path built around email.

Guides for this path

• Most Common Psychological Tactics Used in Social Engineering AttacksIn 2025, a threat group went from a single help-desk phone call to full domain administrator access in about forty minutes, without using any malware. This is what social engineering psychological tactics actually look like: authority, urgency, fear, and helpfulness, stacked together and aimed at the mental shortcuts that make normal professional life possible. Here is how each lever works, why training alone doesn't stop them, and the defenses that hold up under pressure.

Frequently asked questions