Received header
Delivery hop
Each mail server that handles a message stamps a Received line. Read them bottom-up: the lowest is the origin, the highest is your own gateway. Gaps, odd geographies or unexpected relays are your first signal.
Analyst glossary
Terminology in email phishing
Every term you will meet in a RealCyberWork case, defined the way a SOC actually uses it. Learn the vocabulary here, then apply it in guided training and real investigations.
Delivery & headers
How a message physically reached the mailbox, and what proves it.
Envelope sender (MAIL FROM / Return-Path)
Who the servers talk to
The address the sending server declares during SMTP. Bounces go here, and SPF is checked against it. It frequently differs from the friendly From address the user sees.
From vs Display name
What the user sees
The display name is free text an attacker can set to anything, including a colleague's name. Only the address inside the angle brackets carries meaning.
Reply-To mismatch
Where the answer goes
A message that appears to come from one domain but routes replies to another is a classic BEC and callback-fraud pattern.
Message-ID
Unique fingerprint
A per-message identifier issued by the originating server. Useful for message trace, deduping campaign copies and proving which exact mail was analysed.
Sender authentication
The three checks that decide whether a sending domain is genuine.
SPF
Authorised sending IPs
A DNS record listing which servers may send for a domain. A pass only means the envelope domain authorised that IP — it says nothing about the visible From address.
DKIM
Cryptographic signature
The sending domain signs parts of the message with a private key; receivers verify it against a public key in DNS. A pass proves the signing domain vouched for the content and that it was not altered in transit.
DMARC alignment
Ties auth to the visible domain
DMARC requires that the SPF or DKIM domain aligns with the domain the user actually sees in From. SPF and DKIM can both pass while DMARC fails — that combination is the single most common giveaway in spoofing cases.
Lookalike / cousin domain
Almost the real thing
A domain registered to resemble a legitimate one through character swaps, added words or different TLDs. It authenticates perfectly because the attacker owns it.
Domain age
Registration recency
Domains registered days before a campaign are strongly suspicious. Check creation date, registrar and name servers alongside reputation.
Payload & content
The parts of the message designed to make someone act.
Pretext
The story
The scenario used to justify the request — payroll change, invoice update, expiring password. Name it explicitly; it drives which pillars matter.
Pressure levers
Urgency, authority, secrecy
Deadlines, executive impersonation and 'keep this confidential' instructions exist to stop the recipient verifying through a second channel.
Defanging
Safe notation
Rewriting indicators so they cannot be clicked or resolved by accident, for example hxxps://evil[.]com. Every indicator shared outside a sandbox should be defanged.
Redirect chain
Hop path of a link
The sequence of URLs a link passes through before its landing page. Attackers hide credential-harvest pages behind trusted redirectors and link shorteners.
Quishing
QR-code phishing
The payload is embedded in a QR image so link scanners see nothing, and the victim opens it on an unmanaged phone.
Macro / double extension
Attachment tricks
Office macros and file names like invoice.pdf.exe execute code while looking inert. Judge the true file type from its signature, not its name.
Attack types
Names you will use when you classify a case.
Credential harvesting
Steal the password
A cloned login page captures credentials, and often the MFA code too, then hands the session to the attacker.
BEC
Business email compromise
Text-only fraud with no link or attachment, relying on impersonation and payment or payroll changes. Content, identity and process controls carry the investigation.
AiTM
Adversary in the middle
A reverse-proxy phishing kit relays the real login page in real time and steals the session token, bypassing MFA. A password reset alone does not contain it — sessions must be revoked.
TOAD / callback fraud
Phone-based lure
A benign-looking invoice asks the victim to call a number, moving the attack to a voice channel that leaves no email indicators.
Lateral phishing
From a real colleague
Sent from an already-compromised internal mailbox, so authentication passes and trust is high. Look at inbox rules and sign-in history, not just the message.
OAuth consent abuse
Malicious app grant
The victim grants a rogue application persistent mailbox access. No password is stolen, so resetting one changes nothing — the grant must be revoked.
MFA fatigue
Push bombing
Repeated authentication prompts until the user approves one out of irritation. Sign-in logs show a burst of denials followed by a single approval.
Response & reporting
What you produce and what you pull once the picture is clear.
IOC
Indicator of compromise
An observable tied to the attack: sender address, domain, URL, IP, file hash. Each one should carry a type, confidence and the evidence it came from.
Containment sequencing
Order matters
Revoke sessions and tokens before resetting a password, then purge the campaign and block indicators. Reversing the order lets a stolen session survive.
Blast radius / scope
Who else got it
The count of recipients, deliveries, clicks and submissions across the tenant. A case is not closed until scope is measured, not assumed.
Chain of custody
Evidence discipline
Preserve the original .eml, hash it, and record who handled it and when so the findings hold up in review.
MITRE ATT&CK mapping
Shared language
Tagging observed behaviour to techniques such as T1566 Phishing gives detection engineers and management a common reference.
True positive / false positive
The verdict
Your classification of the report, stated with confidence, rationale and the evidence that supports it — never a guess.