Now you'll build a practical project around one of the most common cybersecurity threats: phishing.
The goal isn't to create phishing emails. Instead, you'll learn how security analysts identify suspicious messages, analyze evidence, and decide whether an email is legitimate or malicious.
⚠️ Use only sample emails, your own test mailbox, or authorized training material.
🎯 Project Objective
By completing this project, you'll learn how to:
Identify phishing indicators
Analyze email headers
Inspect suspicious URLs safely
Understand SPF, DKIM, and DMARC
Detect social-engineering techniques
Create a phishing investigation report
🧠 Step 1: Understand the Phishing Workflow
A typical phishing attack may look like:
Attacker
↓
Fake Email
↓
Victim
↓
Malicious Link / Attachment
↓
Credential Theft / Malware
↓
Account or System Compromise
Your job as a security analyst is to break this chain.
🔍 Step 2: Learn the Warning Signs
Look for:
🚨 Urgency
"Your account will be suspended today!"
🎣 Suspicious Links
The displayed text may not match the actual destination.
👤 Impersonation
The sender may pretend to be:
Bank
HR
IT department
CEO
Delivery company
📎 Unexpected Attachments
Especially files you weren't expecting.
💰 Financial Requests
Unexpected requests for:
Money transfers
Gift cards
Bank details
Payment information
📧 Step 3: Analyze Email Headers
Email headers contain technical information about how an email was delivered.
Look for:
Sender information
Recipient information
Mail servers
Timestamps
Authentication results
Many email clients provide an option such as:
"Show original" or "View source."
🔐 Step 4: Understand SPF
SPF (Sender Policy Framework) helps a domain specify which mail servers are authorized to send email on its behalf.
Conceptually:
Email claims:
"I am from example.com"
↓
SPF Check
↓
Is the sending server authorized?
↓
Pass / Fail
🔏 Step 5: Understand DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email.
The receiving mail system can verify the signature.
This helps detect unauthorized modification and supports domain-level email authentication.
🛡️ Step 6: Understand DMARC
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM.
It allows domain owners to specify how receiving mail systems should handle messages that fail authentication checks.
Possible policies include:
Monitor
Quarantine
Reject
🔥 SPF vs DKIM vs DMARC
Technology - Main Purpose
SPF - Verifies authorized sending servers
DKIM - Verifies cryptographic email signatures
DMARC - Defines policy and improves domain protection
Together, they provide stronger email authentication.
🔗 Step 7: Inspect Links Safely
Never blindly click a suspicious link.
Instead, inspect the destination carefully.
Ask:
Does the domain match the claimed organization?
Is there a suspicious spelling variation?
Is the URL unusually long?
Does the link use a URL shortener?
Is the destination unexpected?
