analyzing-email-headers-for-phishing-investigation

1# Analyzing Email Headers for Phishing Investigation
2 
3## When to Use
4- When investigating a suspected phishing email to determine its true origin
5- For verifying sender authenticity and detecting email spoofing
6- During incident response when a user has clicked a phishing link
7- When tracing the delivery path and relay servers of a suspicious email
8- For validating SPF, DKIM, and DMARC alignment to identify forgery
9 
10## Prerequisites
11- Raw email headers from the suspicious message (EML or MSG format)
12- Understanding of SMTP protocol and email header fields
13- Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification
14- Email header analysis tools (MHA, emailheaders.net concepts)
15- Python with email parsing libraries for automated analysis
16- Access to threat intelligence platforms for IP/domain reputation
17 
18## Workflow
19 
20### Step 1: Extract Raw Email Headers
21 
22```bash
23# Export from Outlook: Open email > File > Properties > Internet Headers
24# Export from Gmail: Open email > Three dots > Show original
25# Export from Thunderbird: View > Message Source
26 
27# If working with EML file from forensic image
28cp /mnt/evidence/Users/suspect/AppData/Local/Microsoft/Outlook/phishing_email.eml \
29   /cases/case-2024-001/email/
30 
31# If working with PST file, extract individual messages
32pip install pypff
33python3 << 'PYEOF'
34import pypff
35 
36pst = pypff.file()
37pst.open("/cases/case-2024-001/email/outlook.pst")
38root = pst.get_root_folder()
39 
40def extract_messages(folder, path=""):
41…