How to Identify a Phishing Email: Complete Analysis Guide

Why email is still the #1 attack vector

Email remains the most common entry point for cyberattacks. Most successful breaches start with a single message landing in someone's inbox. The attacker doesn't need to break through a firewall, they just need one person to click a link or open an attachment.

A phishing email is a fraudulent message designed to trick the recipient into doing something that benefits the attacker. That action could be entering login credentials on a fake site, downloading malware, opening a macro-enabled document, approving an MFA request, sending money, or simply replying with sensitive information. The organisations being impersonated are almost always ones people trust without thinking, banks, Microsoft, Google, Amazon, PayPal, HR departments, or a message that appears to come from the CEO.

This guide covers every component of an email and how a SOC analyst examines each one.

Anatomy of an email

Most people see the display name, subject line, and message body. That's exactly what attackers count on. A full analysis touches every part of the message.

1. Display name vs. sender address

Most users only read the display name. Attackers know this. The name can say "Microsoft Support" while the actual sending address is something like support@microsoft-verify-account.xyz. Email clients often hide the raw address by default, which is why this trick works so reliably.

One of the subtler variants is typosquatting, registering a domain that looks nearly identical to a legitimate one. The letters rn side by side look almost exactly like m, so rnicrosoft.com can pass a quick glance.

Attackers also add words to the domain to make it look official: paypal-security.com, secure-paypal.org, microsoftverify.com. None of these belong to the real companies. Always check the actual domain, not the words around it.

2. Subject line

The subject line is designed to get you to open the email before thinking. Phishing subjects almost always trigger one of three emotions: fear, urgency, or curiosity. Common examples include "Your account will be closed", "URGENT: Invoice attached", "Suspicious login attempt detected", and "Package delivery failed, action required".

Legitimate organisations rarely demand action within minutes and don't phrase things to create panic. If the subject line made your heart rate go up slightly, that's intentional, slow down rather than speed up.

3. Greeting

A company that has your account knows your name. Phishing emails use generic greetings like "Dear Customer", "Dear User", or "Hello Member" because the same message is being sent to millions of people simultaneously. A generic greeting isn't proof the email is malicious, but it's a flag worth noting alongside the other signals.

4. Message body

Read the content carefully and look for inconsistencies. Grammar mistakes, spelling errors, awkward phrasing, mismatched fonts, random colour changes, broken images, and incorrect logos all suggest the email wasn't produced by a legitimate organisation's communications team. AI tools have made phishing emails more convincing in recent years, but inconsistencies still appear, especially in the formatting and in phrases that don't quite match how the impersonated company normally communicates.

5. Psychological tactics

Phishing works because it exploits predictable human responses. SOC analysts recognise these as social engineering techniques rather than coincidences.

If an email is pushing you toward a fast decision, that pressure itself is a red flag. Real organisations give you time.

6. Hyperlink analysis

Never trust visible link text. An email can display https://paypal.com while the actual URL underneath points to http://paypal-login-security.xyz. Always hover over a link before clicking, your browser shows the real destination in the status bar.

Things to check in a URL: is the domain legitimate or a lookalike? Is it HTTP rather than HTTPS? Does it use an IP address directly instead of a domain name? Is it a URL shortener hiding the real destination? Does it use a long subdomain to bury the real domain at the end?

That last one is worth understanding clearly. In paypal.com.fake-domain.com, the actual domain is fake-domain.com. Everything before the last dot-separated domain is just a subdomain, the attacker has constructed it to look official at a glance.

7. Attachments

Attachments are one of the most reliable malware delivery mechanisms because users are conditioned to open files. The extensions below should trigger immediate caution from anyone in a security role.

Never open a suspicious attachment locally. Use a sandbox tool to detonate it safely, more on that in the tools section below.

8. QR code phishing (quishing)

A growing tactic is replacing clickable links with QR codes. The user scans the code with their phone, which opens a phishing site on a device that typically has fewer security controls than a corporate laptop. The reason this works so well is that you can't hover over a QR code, there's no way to preview the destination before visiting it. If an email asks you to scan a QR code to "verify your account" or "complete a security check", treat it with the same suspicion as a bare link.

9. Email header analysis

Headers are hidden by default in most email clients, but they contain the most technically reliable information about where an email actually came from. Every mail server that handled the message adds a Received: line, and crucially, you read these from bottom to top. The bottom entry is where the email originated. Working upward shows the relay chain all the way to your inbox.

10. Email authentication: SPF, DKIM, DMARC

These three protocols form the technical backbone of email authentication. Together they answer: did this email actually come from who it claims to be from, and has it been tampered with in transit?

A legitimate email from a well-configured domain will pass all three. A spoofed email will typically fail at least one. SPF FAIL or DMARC FAIL on an email claiming to be from a major organisation is a strong indicator of spoofing.

11. Domain and IP reputation

Once you've extracted the sender's domain and originating IP address from the headers, check their reputation. Questions worth asking: when was the domain registered? A domain created yesterday claiming to be Microsoft is immediately suspicious. Is it listed on any blacklists? Has the IP address been reported for malicious activity? Does WHOIS show privacy protection masking the registrant identity? Does the domain have a real website, or does it resolve to nothing?

Brand new domains and IPs with abuse reports are two of the most reliable signals that something is off.

12. Business Email Compromise (BEC)

Not every phishing email contains malware or a malicious link. Business Email Compromise is a category where the entire attack is social engineering, no technical payload required. A classic example is an email appearing to come from the CEO asking an employee to urgently purchase gift cards and send the redemption codes, or a fake vendor invoice redirecting payment to a new bank account.

These attacks are often harder to detect technically because the emails can pass all authentication checks (if the attacker has compromised the real account) and contain no suspicious URLs or attachments. The signal is in the request itself, unusual urgency, an out-of-character ask, pressure to bypass normal approval processes, or a request to keep things confidential.

Safe analysis process

When a suspicious email arrives, whether reported by a user or caught by a filter, this is the order to work through it.

1. Don't click links or open attachments until the analysis is complete.
2. Verify the full sender address, not just the display name.
3. Check the Reply-To and Return-Path for mismatches with the From address.
4. Hover over every link to check the real destination URL.
5. Note any urgency, fear, authority, or reward pressure in the content.
6. Pull the full email headers and read the Received chain bottom to top.
7. Check SPF, DKIM, and DMARC authentication results.
8. Look up the sender domain's registration date and reputation.
9. Check the originating IP against abuse and blacklist databases.
10. Scan any URLs or attachments using sandbox tools, never open locally.
11. If still unsure, contact the claimed sender through an official channel that you find independently, not the details in the email.
12. Report to your security team so the threat can be blocked for other users.

Analysis tools

SOC analyst workflow

When a phishing email is escalated to a SOC team, the investigation follows a structured process rather than an ad-hoc inspection.

1. Preserve the email as evidence in its original form, including headers.
2. Review all components, sender, subject, body, links, and attachments, before touching anything.
3. Extract indicators of compromise (IOCs): sender email address, domains, URLs, IP addresses, file names, and file hashes.
4. Analyse headers to verify the sending path and authentication results.
5. Run reputation checks on all extracted IOCs using threat intelligence platforms.
6. Sandbox suspicious files and URLs to observe behaviour in a controlled environment.
7. Determine scope, how many users received this email? Did anyone click or open anything?
8. Contain by blocking malicious domains and IPs, quarantining the email from other inboxes, disabling compromised accounts, or isolating affected endpoints.
9. Document the full investigation: findings, evidence collected, timeline, and response actions taken.
10. Recommend improvements, updated email filter rules, stronger authentication enforcement, or targeted user awareness training.

Final takeaway

Phishing detection is about looking past the surface. Attackers can replicate logos, copy email formatting, and write convincing prose, but the technical signals underneath are much harder to fake. SPF failures, domain mismatches, suspicious originating IPs, and Reply-To redirections expose the truth even when the visual presentation looks legitimate.