# Phishing

## Email Header :&#x20;

before we can say whether this is a phishing email or not we have to check some important fields like :&#x20;

<mark style="color:red;">From:</mark> indicates the name and email address of the sender.

<mark style="color:red;">To:</mark> basically indicates the name and email address of the receiver. Fields like CC (carbon copy) and BCC (blind carbon copy) also fall under this category.

<mark style="color:red;">Date:</mark> This is the timestamp that shows when the email was sent.

<mark style="color:red;">Subject:</mark> The subject mentions the topic of the email.

<mark style="color:red;">Return-Path Or Reply-to:</mark> If you reply to an email, it will go to the address mentioned in the Return-Path field.

<mark style="color:red;">Domain Key and DKIM Signatures:</mark> The Domain Key and Domain Key Identified Mail (DKIM) are email signatures that help email service providers identify and authenticate your emails, similar to SPF signatures.

<mark style="color:red;">Message-ID:</mark> Multipurpose Internet Mail Extensions (MIME) is an internet standard of encoding. It converts non-text content like images, videos, and other attachments into text so they can be attached to an email and sent through SMTP.

<mark style="color:red;">Received:</mark> The received field lists each mail server that went through an email before arriving in the recipient's inbox. It's listed in reverse chronological order — where the mail server on the top is the last server the email message went through, and the bottom is where the email originated.

<figure><img src="https://3554695797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpkZ2jQy5PAQnYRhE2XnB%2Fuploads%2FITtphv1RHk1l3248SaAb%2Fimage.png?alt=media&#x26;token=04a1cefb-60bc-4309-bbf1-b45a30f0cac6" alt=""><figcaption></figcaption></figure>

## Abnormal-Suspicious :&#x20;

* it is suspicious if the <mark style="color:red;">"From"</mark> field Differs from <mark style="color:red;">"Reply-to"</mark> field.&#x20;
* it is abnormal if the email was <mark style="color:red;">From</mark> someone you don't know (normal in some cases).
* from <mark style="color:red;">Date,</mark> you could know the time the sender send the email so could know when he works.
* Careful the attractive <mark style="color:red;">Subjects</mark>, like " your credential is about to end renew it now"
* you have to search about the Domin the email send from too, if the domain appeared from near time or has any suspicious behavior. you could find it at [mxtoolbox.com](https://mxtoolbox.com/) .
*

```
<figure><img src="https://3554695797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpkZ2jQy5PAQnYRhE2XnB%2Fuploads%2Fu224xEkow81j5rs0vW24%2Fimage.png?alt=media&#x26;token=46964a42-018c-4503-a4b1-f2d98da0bddf" alt=""><figcaption></figcaption></figure>
```

* this examination will check for spoofing too by checking <mark style="color:red;">DMARC, DKIM, and SPF</mark> methods.
* <mark style="color:red;">DMARC, DKIM, and SPF</mark> are three email [authentication](https://www.cloudflare.com/learning/access-management/what-is-authentication/) methods. Together, they help prevent spammers, [phishers](https://www.cloudflare.com/learning/access-management/phishing-attack/), and other unauthorized parties from sending [emails](https://www.cloudflare.com/learning/email-security/what-is-email/) on behalf of a [domain](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name/)\* they do not own.
* DKIM and SPF can be compared to a business license or a doctor's medical degree displayed on the wall of an office — they help demonstrate legitimacy.
* If there are any attachments with the email DON'T TRY to open them, if it was a URL link you have to examine it at [https://www.virustotal.com](https://www.virustotal.com/gui/home/upload) then there is a good site to open the link safely. [https://www.browserling.com](https://www.browserling.com/) , if the attachment was a file examine it at virus total first and you have another option to open it at a virtual machine.

There are many procedures to follow, but they protect you from falling prey to a phishing attack.

&#x20;                                                        <mark style="color:red;">**For questions feel free to message me.**</mark>

&#x20;                                                                   <mark style="color:red;"></mark><mark style="color:red;">**Thank you**</mark>&#x20;
