A practical guide for identifying phishing attempts, email spoofing, and malicious messages.
Introduction
Suspicious emails are one of the most common methods used by cybercriminals to steal credentials, distribute malware, and compromise systems. Whether you’re a home user, IT administrator, or security professional, knowing how to investigate a suspicious email can help prevent security incidents before they occur.
This guide walks through a structured approach to analyzing potentially malicious emails.
Common Signs of a Suspicious Email
Before performing a detailed investigation, look for obvious warning signs:
- Unexpected requests for passwords or multifactor authentication approvals
- Urgent language designed to create panic
- Unusual sender addresses
- Poor grammar or spelling mistakes
- Requests for financial information
- Attachments you were not expecting
- Links to unfamiliar websites
Example
Display Name:
Display Name:
Microsoft Support
Actual Sender:
microsoft-support@security-verification.xyz
The display name appears legitimate, but the email address reveals the message is not from Microsoft.
Step 1: Verify the Sender
Always examine the sender’s email address.
Questions to ask:
- Does the domain match the organization it claims to be from?
- Is the spelling correct?
- Are there extra characters or unusual domains?
Legitimate Example
support@microsoft.com
Suspicious Example
support@microsoft-security-alert.com
Attackers often register lookalike domains hoping recipients won’t notice the difference.
Step 2: Review the Subject Line
Phishing emails frequently use urgency or fear.
Examples include:
- Your Account Will Be Suspended
- Immediate Action Required
- Security Alert
- Payment Failed
- Unusual Sign-In Activity Detected
While legitimate organizations also send alerts, these subjects warrant additional scrutiny.
Step 3: Analyse Embedded Links
Never click a suspicious link immediately.
Instead:
On Desktop
Hover over the link and inspect the destination URL.
Example:
Displayed Link
https://login.microsoftonline.com
Actual Destination
https://microsoftonline.verify-login-security.com
The visible text may disguise the true destination.
Things to Look For
- Misspelled domains
- Unusual top-level domains
- Excessive subdomains
- URL shortening services
Step 4: Inspect Attachments
Treat unexpected attachments with caution.
High-risk attachment types include:
.exe
.js
.vbs
.scr
.bat
.iso
.zip
Even common formats such as Word or Excel files may contain malicious macros.
Questions to ask:
- Was the attachment expected?
- Does the file name make sense?
- Has the sender communicated previously?
Step 5: Check Email Headers
Email headers contain useful routing and authentication information.
Look for:
SPF
Determines whether the sending server is authorized to send email for the domain.
DKIM
Validates that the message content has not been altered.
DMARC
Verifies alignment between the sender and authentication records.
A failed SPF, DKIM, or DMARC result may indicate spoofing.
Step 6: Examine Authentication Results
Many email systems include authentication results in the message headers.
Example:
Plain Text
SPF=PASS
DKIM=PASS
DMARC=PASS
A pass result does not guarantee the message is safe, but multiple failures should raise concerns.
Step 7: Assess the Context
Ask yourself:
- Was I expecting this email?
- Does the request make sense?
- Is the sender behaving normally?
- Does the message align with previous communications?
Even perfectly crafted phishing emails often fail this simple context check.
What To Do If the Email Is Malicious
If you determine an email is malicious:
- Do not click any links.
- Do not open attachments.
- Delete or quarantine the message.
- Inform affected users if necessary.
If credentials were entered:
- Reset the password immediately.
- Revoke active sessions.
- Review recent sign-in activity.
- Enable or re-register multifactor authentication.
Conclusion
Most phishing emails can be identified by carefully reviewing the sender, links, attachments, and context of the message. By following a consistent investigation process, you can significantly reduce the risk of credential theft, malware infections, and business email compromise.
When in doubt, treat the email as suspicious until it can be verified through a trusted source.