Phishing Email Investigation
Preserved a suspicious training message, examined its identity and authentication signals, and produced a defensible analyst handoff without visiting the link.
Completed result: three evidence-backed review findings from one preserved message.
The investigation question
Did the preserved message contain enough observable inconsistency to justify quarantine and escalation without opening its link? I separated what the message showed from what would require mailbox, proxy, DNS, endpoint or user-action evidence.
What I examined
- Preserved the source. Bound the `.eml` fixture to SHA-256 d110efbb542d29e4a0b5e29a2479a637c435d26c98dd872ff85fc6c5e0ba5442
- Compared message identity. The sender and Reply-To domains differ.
- Read the authentication record. SPF failed, DKIM was absent, and DMARC failed in the supplied header.
- Defanged the destination. The single URL points to the Reply-To domain and is displayed without making it clickable.
Finding and response
The combined signals support treating this lab message as suspicious. My response would quarantine it, search for matching indicators, verify the request through a trusted channel, and investigate surrounding telemetry before claiming compromise or user impact.
Inspect the evidence
Academic foundation
Completed coursework: IST 5250 Incident Handling & Cyber Investigation (Fall 2024). The transcript confirms the course; this newly executed portfolio lab supplies its own evidence and is not presented as an archived class assignment.
Scope and evidence
The message is a harmless lab-created fixture using reserved domains. No live mailbox, domain, attachment or public target was contacted. The completed claim covers the preserved offline analysis and report only.