Spam and Phishing are common social engineering attacks. In social engineering, phishing attack vectors can be a phone call, a text message, or an email. As you should have already guessed, our focus is on email as the attack vector.
There are 3 specific protocols involved to facilitate the outgoing and incoming email messages:
2 parts of an email
Header → Information about the email such as email servers that relayed the email. There are fields in the email header.
Other information about the email header
X-Originating-IP → The IP address of the email was sent from (known as X-Header)
smtp.mailfrom/header.from → The domain the email was sent from (these headers are within Authentication-Results)
Reply-to → This is the email address a reply email will be sent to instead of a from email address. This means that if there are reply to that is not to the sender then that’s malicious.
Return-Path → The email address for return mail. This is the same as "Reply-To:".
Envelope-To → This header shows that this email was delivered to the mailbox of a subscriber whose email address is [email protected].
Delivery Date → This shows the date and time at which the email was received by your (mt) service or email client.
Received → The received is the most important part of the email header and is usually the most reliable. They form a list of all the servers/computers through which the message traveled in order to reach you.
The received lines are best read from bottom to top. That is, the first "Received:" line is your own system or mail server. The last "Received:" line is where the mail originated. Each mail system has its own style of "Received:" line. A "Received:" line typically identifies the machine that received the mail and the machine from which the mail was received.
DKIM-Signature & Domainkey-Signature → is an email authentication method designed to detect forged sender addresses in emails. It helps protect recipients from email spoofing, phishing, and spam.
Message-id → A unique string assigned by the mail system when the message is first created. These can easily be forged.
Mime-Version → Multipurpose Internet Mail Extensions (MIME) is an Internet standard that extends the email format.
Content-Type → Generally, this will tell you the format of the message, such as html or plaintext.
X-Spam-Status → Displays a spam score created by your service or mail client
X-Spam-Level → Displays a spam score usually created by your service or mail client
Message Body → This is the actual content of the email itself, written by the sender.
We can view email in Text format and HTML format. If there is an attachment we might see or take note of this:
