Phishing Analysis Fundamentals: Email Delivery, Header Analysis, and Phishing Techniques

Introduction

Welcome to my walkthrough of the room Phishing Analysis Fundamentals! This room is the first room in the Phishing Analysis module of the SOC Level 1 path. In my previous article, I walked through Eviction, the challenge room that closed the Cyber Defence Frameworks module, where we used the MITRE ATT&CK Navigator to map APT28's techniques from reconnaissance to command and control.

Phishing is one of the most common ways attackers get their first foothold in an organization, so this module is where SOC analysts learn to take a suspicious email apart piece by piece. In this room, we follow an email from sender to inbox, dig into its headers and raw source, rebuild an attachment from base64, and analyze a real phishing sample in Thunderbird.

Catch up on my previous article, Eviction, by clicking the banner below.

What we will cover

• The anatomy of an email address
• How SMTP, POP3, IMAP, and DNS work together to deliver email
• Reading email headers and the raw message source in Thunderbird
• Inspecting HTML bodies and reconstructing base64 encoded attachments
• The main types of phishing and the telltale signs of a phishing email
• Defanging indicators for safe analysis
• Answers to the room questions

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Phishing Analysis Fundamentals
• Path: SOC Level 1
• Module: Phishing Analysis
• Topic: Email Delivery, Email Header Analysis, Phishing Techniques
• Difficulty: Easy
• Room Link: TryHackMe — Phishing Analysis Fundamentals

Task 2: The Email Address

Every phishing investigation starts with something simple: an email address. Email as we know it was popularized on ARPANET in the 1970s by Ray Tomlinson, who introduced the @ symbol to separate the user from the destination system. Attackers rely on small tricks in this structure, so knowing how it is built is the first step to spotting them.

An email address has three parts:

• Username: identifies the specific recipient's mailbox on the mail server
• @ symbol: separates the username from the domain and tells the system where to route the message
• Domain name: specifies the mail server responsible for receiving the message

In this example, the intended recipient username is david and the intended recipient domain is tryhackme.com. A helpful analogy is a home mailing address: the domain is the street or apartment building, and the username is the specific person or mailbox at that location. With both, the postal worker (the mail server) knows exactly where to deliver the message.

Questions and Answers

Identify the domain used in the following email address: hatsalesman@tryhatme.com

Answer:

tryhatme.com

tryhatme.com

Task 3: Email Delivery

Several protocols work together behind the scenes to move an email from sender to recipient. SMTP (Simple Mail Transfer Protocol) sends email, while POP3 (Post Office Protocol) and IMAP (Internet Message Access Protocol) are used to retrieve it. With POP3, messages are downloaded to a single device and typically removed from the server. With IMAP, messages stay on the server and are synced across every device you use.

The easiest way to understand these protocols is to follow an email's journey:

1. The sender's email client hands the message to its mail server using SMTP.
2. The sending server asks DNS for the mail server of the recipient's domain.
3. DNS responds with the address of the recipient's mail server.
4. The message travels across the Internet to the recipient's server.
5. The recipient's email client connects to their mail server.
6. The message is downloaded (POP3) or synced (IMAP) to the recipient's device.

Questions and Answers

Which protocol is responsible for sending an email from a client to a mail server?

Answer:

SMTP

SMTP

Which service is used to look up the recipient domain's mail server?

Answer:

DNS

DNS

Bob wants to access his email from multiple devices, including his phone and laptop. Which protocol should he use?

Answer:

IMAP

IMAP

Task 4: Email Headers

An email has two main parts: the header, which holds metadata such as the sender and the servers involved in delivery, and the body, which holds the actual message as plain text or HTML. The header is where most of the investigative value lives, because it records where a message really came from rather than where it claims to come from.

The fields you see in a normal inbox view are From (the sender), To (the recipient), Reply To (where replies go, which is optional and often abused by attackers), Subject, and Date. Viewing the message source goes much further: it shows the full raw message, including every header field, the originating IP address, and the body exactly as it was transmitted.

Guided Walkthrough: Reading the Header of email1.eml

Start the machine from Task 1 and open the Email Samples folder on the desktop. Double click email1.eml to open it in Thunderbird Mail. The header area at the top of the message lists the From, To, Reply to, and Subject fields, with the date on the right. Read the full subject line from the Subject field. Notice also the yellow banner: Thunderbird has blocked the remote content in this message, which is why the images in the body appear as empty placeholders.

Next, open the raw message by choosing View then Message Source from the menu, or by pressing Ctrl+U. A new window titled Source of opens with every header field in plain text. The X-Originating-Ip field sits near the top, just below the Received and Return-Path lines. If you want to double check the value, the Received-SPF line right below it names the same IP address as a permitted sender for the domain.

Questions and Answers

What is the full subject line of email1.eml?

Answer:

Help protect your budget by protecting your home

Help protect your budget by protecting your home

View the message source of email1.eml using Thunderbird in your VM. What is the IP address listed as the X-Originating-Ip?

Answer:

43.255.56.161

43.255.56.161

Task 5: Email Body

The email body carries the message itself, either as plain text or as HTML, which supports images, links, and styling. Email clients show the rendered version, but the underlying source reveals where links really point, which images are loaded from remote servers, and what else is embedded that the reader never sees. Thunderbird blocks remote images by default, which is a good reason to inspect the source rather than trust the rendered view.

Attachments live in the source too. Each attachment is stored as a MIME part with a few key headers: Content-Type gives the file type, Content-Disposition marks the part as an attachment and includes its filename, and Content-Transfer-Encoding shows how the file is encoded, usually base64. The block of base64 text that follows is the file itself, and decoding it reconstructs the original attachment.

Guided Walkthrough: Reconstructing the Attachment in email2.txt

Open email2.txt from the Email Samples folder. It opens in the Mousepad text editor, and the attachment headers are right at the top, below the MIME boundary line. The value at the start of the Content-Type line answers the first question. The same line carries filename and name parameters, and the Content-Disposition line repeats the filename, so you can read the attachment's name from either one. The Content-Transfer-Encoding line confirms that the data below is base64.

A handy detail: the base64 block begins with JVBERi0x, which is how the PDF file signature %PDF-1 looks once it is base64 encoded. Seeing those characters is a quick way to recognize an encoded PDF without decoding anything.

To recover the file and read the flag, copy the whole base64 block from the body of the email (everything below the headers). Open the APIVoid Base64 to PDF converter, paste the block into the text box, and click Generate PDF Document. The tool decodes the data and shows the rebuilt PDF in a viewer just below the button, where the flag is printed on the first page. CyberChef works too: the From Base64 operation decodes the data, but you then have to save the output as a .pdf file and open it to read the flag.

Questions and Answers

Open up the email2.txt file to view the source of an attachment. What is the Content-Type of the attachment?

Answer:

application/pdf

application/pdf

What is the name of the attachment from the previous question?

Answer:

zmqpalgh.pdf

zmqpalgh.pdf

Decode the base64 string using either a PDF converter or CyberChef. What is the hidden flag value?

Answer:

THM{BENIGN_PDF_ATTACHMENT}

THM{BENIGN_PDF_ATTACHMENT}

Task 6: Types of Phishing

Malicious email comes in several forms. Spam is unsolicited bulk email (its malicious variant is called malspam). Phishing impersonates a trusted entity to steal information, spear phishing targets a specific person or organization with personalized details, and whaling is spear phishing aimed at executives such as the CEO or CFO. The same tricks also move off email: smishing uses SMS, and vishing uses voice calls.

Whatever the goal, phishing emails share familiar traits: a spoofed From address (noreply@microsof.com), an urgent subject or message, brand impersonation with copied logos and colors, grammar and spelling issues (less common now that attackers use AI), generic greetings like "Dear Customer", hidden or shortened links, and malicious attachments disguised as harmless files (invoice.pdf.exe).

When documenting indicators, always defang them so nobody can click them by accident. Defanging replaces special characters with bracketed versions, so http://www.suspiciousdomain.com becomes hxxp[://]www[.]suspiciousdomain[.]com, and an IP address has each dot wrapped as [.].

Guided Walkthrough: Investigating email3.eml

Open email3.eml from the Email Samples folder in Thunderbird. The subject claims an order was placed successfully, and the body is little more than a large orange CLICK HERE button with an unsubscribe footer: a typical lure. Both answers for the first two questions are in the From field. The display name starts with "Thank you!" followed by the name of the well known company being impersonated (1), and the actual sender address sits between the angle brackets (2). Compare the two and you will see the address's domain has nothing to do with the brand, which is a classic sign of spoofing.

Now press Ctrl+U to open the message source. The X-Originating-Ip field is near the top, just below Return-Path (1). Copy the IP address and defang it before submitting by replacing each dot with [.], exactly as shown in the defanging example above.

For the last question, look two lines further down at the Authentication-Results header (2). This header is added by the receiving mail server after it checks the message's SPF, DKIM, and DMARC records, and the hostname of that server is the value that appears right after the header name, before the first semicolon.

Questions and Answers

Which reputable organization is being spoofed in this phishing attempt?

Answer:

Home Depot

Home Depot

What is the sender's email address?

Answer:

support@teckbe.com

support@teckbe.com

Inspect the email message source. What is the defanged X-Originating-IP?

Answer:

103[.]234[.]236[.]83

103[.]234[.]236[.]83

Continue analyzing the email message source. Which mail server generated the Authentication-Results header?

Answer:

atlas102.free.mail.gq1.yahoo.com

atlas102.free.mail.gq1.yahoo.com

Task 7: Conclusion

The room closes by introducing one more attack worth knowing: Business Email Compromise (BEC). In a BEC attack, the adversary gains access to a legitimate internal email account and uses it to trick colleagues, partners, or finance teams into fraudulent actions such as paying fake invoices. Because the message comes from a real account, many of the usual red flags in the header never appear, which makes BEC especially dangerous.

Questions and Answers

What attack, signified by the acronym BEC, uses a compromised email to trick employees into fraud?

Answer:

Business Email Compromise

Business Email Compromise

Summary & Key Takeaways

Great work completing Phishing Analysis Fundamentals! This room laid the groundwork for the whole Phishing Analysis module: you now know how email travels, where to find the evidence in its headers and source, and how to recognize the tricks attackers use to make a message look legitimate.

Key lessons:

• An email address consists of a username, the @ symbol, and a domain, and attackers often abuse look alike domains.
• SMTP sends email, DNS locates the recipient's mail server, and POP3 or IMAP retrieves the message.
• The message source (Ctrl+U in Thunderbird) exposes header fields like X-Originating-IP and Authentication-Results that the inbox view hides.
• Attachments are embedded as base64 encoded MIME parts and can be rebuilt with an online Base64 to PDF converter or CyberChef.
• Phishing ranges from bulk spam to targeted spear phishing and whaling, and extends to SMS (smishing) and voice calls (vishing).
• Always defang URLs, domains, and IP addresses when documenting indicators.
• Business Email Compromise uses a genuine internal account, so it can bypass many header based checks.

Next up is Phishing Emails in Action, where we analyze real phishing emails and the techniques attackers use to deceive their victims. Click the banner below to check it out!