Phishing Email Investigation

Problem

A user reports a suspicious email that may be a phishing attempt.

Symptoms

Urgent or threatening tone demanding immediate action
Sender address looks slightly wrong (lookalike domain)
Unexpected attachment or link asking for credentials

Possible Causes

N/A — this is an investigation workflow, not a fault to fix

Diagnostic Steps

Check the actual sender address (not just the display name) for a lookalike or spoofed domain
Hover over (don't click) any links to see the real destination URL
Check email headers for SPF/DKIM/DMARC authentication results
Check if other users received the same or similar message

Commands & Tools

View full email headers (client-specific)nslookup senderdomain.com (to check if the domain even resolves/exists)

Step-by-Step Solution

Do not click links or open attachments in the suspicious email
Report it through your organization's official phishing-report mechanism
If credentials were already entered, reset the password immediately and check sign-in logs for unauthorized access
Block the sender domain and search the mail system for the same message sent to other users
Notify affected users if the campaign is confirmed to be organization-wide

Verification

The message is removed or quarantined organization-wide, and no evidence of credential compromise appears in sign-in logs.

Common Mistakes

Clicking a link "just to see" what it does
Only handling the one reported copy without searching for others sent to different users
Not checking sign-in logs after a user admits they entered credentials

Escalation Criteria

Escalate to the security team immediately if credentials were entered, if the email appears highly targeted (spear phishing), or if it references internal, non-public information.

Prevention

Ongoing user awareness training, DMARC/SPF/DKIM enforcement, and a simple, well-publicized one-click phishing report button.