analyzing-email-headers-for-phishing-investigation

What problem does it solve?

Phishing emails often spoof senders and obfuscate delivery paths; this skill provides automated header analysis to trace origin, verify authenticity, and identify spoofing indicators.

Core Features & Use Cases

• Parse email headers to extract key fields (From, To, Date, Message-ID, Return-Path, Received chain).
• Validate SPF/DKIM/DMARC results using Authentication-Results headers and DNS lookups.
• Map delivery path via Received headers (bottom-up) to identify hops and relays.
• Detect header anomalies such as From/Reply-To mismatch, URL display/href mismatches, and suspicious attachments.
• Extract URLs and attachments for further analysis and reputation checks.

Quick Start

Analyze a raw email file (EML) to produce a header analysis report and phishing indicators.