Lesson 3.71: Anatomy of a phishing e-mail
Most breaches start with an e-mail. A phishing message pretends to come from someone you trust and pushes you to act fast: click, log in, pay, change bank details. The visible parts (sender name, link text, logo) are easy to fake; the headers and the real link target are harder. In the lab you take apart a 'payroll' e-mail: compare its sender fields, read the authentication results your mail server recorded, find where the link really goes, compare it with a genuine message and report it the right way.
17 min
You will learn to
- Spot pressure tactics in a message
- Compare From, Reply-To and Return-Path
- Read SPF, DKIM and DMARC results
- Find the real target behind link text
- Report phishing without clicking
Key terms
- Phishing
- A message that impersonates a trusted sender to make you click, log in, pay or reveal data.
- Header
- Lines at the top of an e-mail recording sender, route and checks; most mail clients hide them.
- SPF / DKIM / DMARC
- Checks that a server may send for a domain (SPF), a domain signature is valid (DKIM), and both align with the visible From (DMARC).
- Reply-To
- Where replies go; often differs from From in phishing.
- Business e-mail compromise
- Fraud that uses fake or hijacked business e-mail to redirect payments.
← TLS in practice · All lessons · Joiners, movers and leavers →