Threat Email IDs are widely used for phishing, Business Email Compromise (BEC), ransomware distribution, credential harvesting, and identity theft. Reports indicate that approximately 88-90% of threat emails are spoofed or used to facilitate malware delivery. Therefore, effectively investigating and identifying such emails requires looking beyond the display name and examining the digital traces and technical indicators associated with the communication.
Threat Email Analysis Framework: A Step-by-Step Approach
1. Analyze Core Details: Extract the full sender address, full email headers, date/time timestamps, subject, and body content.
2. Analyze Email Headers: Inspect the originating IP, mail server routing path, and authentication protocols (SPF, DKIM, and DMARC).
3. Trace the IP Address: Identify geolocation, ISP/hosting provider details, and check for proxy or VPN usage.
4. Verify Domain & Infrastructure: Perform WHOIS queries, inspect DNS records, check domain age, and uncover connected hosting servers.
5. Pivot via OSINT & Digital Footprints: Search for related social accounts, breach histories, and open-source intelligence leads associated with the identity.
6. Correlate & Generate Actionable Intelligence: Connect related evidence, reconstruct the attack timeline, and identify actionable insights.
Scenario: A person receives an email in which the sender claims to be from Microsoft and asks the recipient to open the attached invoice for urgent invoice verification like Payment receipt for a Microsoft purchase.
From: [email protected]
To: [email protected]
Subject: Urgent: Invoice Verification Required
Attachment: Invoice_2026.xlsm
- Analyze Core Details
Sender: [email protected]
Date:28-Oct-2026 09:15 UTC
Subject: Urgent: Invoice Verification Required
Attachment: Invoice_2026.xlsm
Message Content: Please review attached invoice immediately.
Assessment
Domain contains: micr0soft-support.com instead of : microsoft.com
The number “0” is replacing the letter “o”.
Observation: This is a classic typosquatting technique designed to fool users.
- Analyze Email Headers
Header Extract Received: from mail.micr0soft-support.com IP 185.220.101.45
Findings
Originating IP: 185.220.101.45
SPF: FAIL means Sender not authorized.
DKIM : NONE means No valid signature.
DMARC : FAIL means Authentication failed.
( SPF, DKIM and DMARC fields are available in header section)
Assessment: The email claims to represent Microsoft, but all authentication controls are failed.
- Tracing IP Address
IP Investigation 185.220.101.45
Findings
| Parameter | Result |
| Country | Germany |
| ASN | Anonymous Hosting may be VPN/ToR/Proxy |
Assessment: The attacker is attempting to conceal their identity through anonymized infrastructure.
Result : IP 185.220.101.45: becomes an IOC (Indicator of Compromise).
4, Verify IP: 185.220.101.45
Use : blacklist database
Findings : hit in blacklisted IP database
Assessment : Same IP observed in Phishing campaigns, Credential theft attacks and Malware delivery
- Verify Domain & Infrastructure (perform WHOIS Query)
Use: WHOIS Lookup, IP2Location, MaxMind, Shodan tool
- Pivot Through OSINT & Digital Footprints
Use: Google Dorking tool & other tools
Key IOCs
Email Address [email protected]
Domain micr0soft-support.com.
Source IP 185.220.101.45
Summary
The investigation identified a phishing email impersonating Microsoft through the use of a typosquatted domain, micr0soft-support.com. Analysis of the email headers confirmed failures of SPF, DKIM, and DMARC authentication checks also other search indicators suggest that the message originated from anonymized hosting infrastructure and was used to deliver a credential-stealing malware attachment.
Useful Tools for Threat Email Investigation
| Header & DNS Analysis | MXToolbox, Email Header Analyzers, Wireshark |
| Domain & IP Reconnaissance | WHOIS Lookup, IP2Location, MaxMind, Shodan |
| Threat & Breach Intelligence | VirusTotal, Have I Been Pwned (HIBP), Intelligence X |
| Advanced Pivot Search | Google Dorking |
