Reading the message itself — headers, authentication results, sender red flags, content,
attachments, and what to extract once it's confirmed. Where the OSINT Field Toolkit tells you
which site to check, this is the manual read that tells you what to check for.
Click any card for why it matters, what a suspicious value looks like, its IOC type, and exactly how to check it.
Header Analysis
Phase 1
Before touching the body or a single link — the routing metadata almost never lies the way the visible message does.
View raw source / View original → read Received: from the bottom up
SPF / DKIM / DMARC
Phase 1 · Authentication
The three mechanisms that validate the sending domain technically — and the important caveat that passing all three doesn't mean the message is trustworthy.
Header field: Authentication-Results:
Sender & Domain Red Flags
Phase 1 · Phase 2
The parts of the sending domain itself worth a second look, independent of whether authentication technically passed.
Compare the sending domain character by character against the real one
Content & Social Engineering
Phase 2
What the message is actually trying to make the reader feel and do, independent of any technical indicator.
Read the message the way the intended victim would, not as an analyst
Attachment & Link Analysis
Phase 3
What the message actually delivers, and how to look at it without becoming the next victim yourself.
Never open an attachment or follow a link directly — always through a sandbox
IOC Extraction & Escalation
Phase 4
Turning what you found into indicators others can block on, and a case record someone else can trust.
Sender, Reply-To, every URL, attachment hash — the standard extraction set