Now you'll build a practical project around one of the most common cybersecurity threats: phishing.
The goal isn't to create phishing emails. Instead, you'll learn how security analysts identify suspicious messages, analyze evidence, and decide whether an email is legitimate or malicious.
โ ๏ธ Use only sample emails, your own test mailbox, or authorized training material.
๐ฏ Project Objective
By completing this project, you'll learn how to:
Identify phishing indicators
Analyze email headers
Inspect suspicious URLs safely
Understand SPF, DKIM, and DMARC
Detect social-engineering techniques
Create a phishing investigation report
๐ง Step 1: Understand the Phishing Workflow
A typical phishing attack may look like:
Attacker
โ
Fake Email
โ
Victim
โ
Malicious Link / Attachment
โ
Credential Theft / Malware
โ
Account or System Compromise
Your job as a security analyst is to break this chain.
๐ Step 2: Learn the Warning Signs
Look for:
๐จ Urgency
"Your account will be suspended today!"
๐ฃ Suspicious Links
The displayed text may not match the actual destination.
๐ค Impersonation
The sender may pretend to be:
Bank
HR
IT department
CEO
Delivery company
๐ Unexpected Attachments
Especially files you weren't expecting.
๐ฐ Financial Requests
Unexpected requests for:
Money transfers
Gift cards
Bank details
Payment information
๐ง Step 3: Analyze Email Headers
Email headers contain technical information about how an email was delivered.
Look for:
Sender information
Recipient information
Mail servers
Timestamps
Authentication results
Many email clients provide an option such as:
"Show original" or "View source."
๐ Step 4: Understand SPF
SPF (Sender Policy Framework) helps a domain specify which mail servers are authorized to send email on its behalf.
Conceptually:
Email claims:
"I am from example.com"
โ
SPF Check
โ
Is the sending server authorized?
โ
Pass / Fail
๐ Step 5: Understand DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email.
The receiving mail system can verify the signature.
This helps detect unauthorized modification and supports domain-level email authentication.
๐ก๏ธ Step 6: Understand DMARC
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM.
It allows domain owners to specify how receiving mail systems should handle messages that fail authentication checks.
Possible policies include:
Monitor
Quarantine
Reject
๐ฅ SPF vs DKIM vs DMARC
Technology - Main Purpose
SPF - Verifies authorized sending servers
DKIM - Verifies cryptographic email signatures
DMARC - Defines policy and improves domain protection
Together, they provide stronger email authentication.
๐ Step 7: Inspect Links Safely
Never blindly click a suspicious link.
Instead, inspect the destination carefully.
Ask:
Does the domain match the claimed organization?
Is there a suspicious spelling variation?
Is the URL unusually long?
Does the link use a URL shortener?
Is the destination unexpected?
