================================================================================
EMAIL HEADER ANALYSIS SAMPLES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY
================================================================================

WARNING: These are fictional headers created for educational purposes.
All IPs, domains, and identifiers are fabricated. Analyzing email headers
from real phishing without authorization may violate applicable laws.

================================================================================
HEADER SET #1 — SPF FAIL + SPOOFED FROM
Scenario: Attacker spoofs CEO's email address from unauthorized mail server
================================================================================

Return-Path: <bounce-3892@mail-relay.example.net>
Delivered-To: jennifer.liu@acmecorp.com
Received: from mx1.acmecorp.com (mx1.acmecorp.com [203.0.113.10])
        by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS
        id <auto-001>;
        Mon, 14 Oct 2025 08:12:41 -0400
Received: from mx1.acmecorp.com (localhost [127.0.0.1])
        by mx1.acmecorp.com (Postfix) with ESMTP id 7B3A2F1C01
        for <jennifer.liu@acmecorp.com>;
        Mon, 14 Oct 2025 08:12:40 -0400
Received: from mail-relay.example.net (unknown [91.195.240.18])
        by mx1.acmecorp.com (Postfix) with ESMTP id 4D1C3F1BFF
        for <jennifer.liu@acmecorp.com>;
        Mon, 14 Oct 2025 08:12:38 -0400
Received: from localhost (vps-node7.hostprovider.ru [185.176.43.112])
        by mail-relay.example.net (Postfix) with ESMTPA id 9E221A034
        auth=plain user=relay-user;
        Mon, 14 Oct 2025 15:12:35 +0300
Authentication-Results: mx1.acmecorp.com;
        spf=fail (sender IP 91.195.240.18 is not authorized for domain acmec0rp.com)
            smtp.mailfrom=bounce-3892@mail-relay.example.net;
        dkim=none (no DKIM signature present);
        dmarc=fail (p=none, no alignment) header.from=acmec0rp.com
X-Spam-Score: 8.7
X-Spam-Status: Yes, score=8.7 required=5.0 tests=SPF_FAIL,DKIM_MISSING,
        DMARC_FAIL,FROM_DOMAIN_NOVOWEL,RCVD_IN_BRBL,SUSPICIOUS_REPLYTO
From: Marcus Webb <marcus.webb@acmec0rp.com>
Reply-To: marcus.webb.ceo@gmail.com
To: jennifer.liu@acmecorp.com
Message-ID: <fake-msgid-001@mail-relay.example.net>
Date: Mon, 14 Oct 2025 08:12:33 -0400
Subject: Urgent — Confidential Acquisition Wire Transfer
X-Mailer: Microsoft Outlook 16.0
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"

--- ANALYSIS ---
INDICATORS OF COMPROMISE:

1. SPF FAIL: Sending IP 91.195.240.18 (mail-relay.example.net) is NOT in
   the SPF record for acmec0rp.com. The legitimate acmecorp.com SPF record
   authorizes only 203.0.113.0/24. This is a different domain entirely.

2. DKIM: No DKIM signature present. Legitimate acmecorp.com emails always
   carry a valid DKIM signature (selector: s1._domainkey.acmecorp.com).

3. DMARC FAIL: The DMARC policy for acmec0rp.com is p=none (monitor only),
   meaning the failure is logged but the email is still delivered. Note: this
   is the LOOKALIKE domain's DMARC, not acmecorp.com's.

4. RETURN-PATH MISMATCH: Return-Path is bounce-3892@mail-relay.example.net,
   but From header claims marcus.webb@acmec0rp.com. These domains do not
   match, indicating envelope-from spoofing.

5. ORIGINATING IP: The earliest Received header shows 185.176.43.112, which
   resolves to vps-node7.hostprovider.ru — a Russian VPS provider. Acme
   Corporation is US-based.

6. REPLY-TO MISMATCH: Reply-To is a Gmail address (marcus.webb.ceo@gmail.com),
   not the corporate domain. Replies go to the attacker, not the real CEO.

7. X-MAILER CLAIM: Claims Microsoft Outlook 16.0, but the Received chain
   shows Postfix on Linux — inconsistent with Outlook sending behavior.

================================================================================
HEADER SET #2 — DKIM MISMATCH + DIFFERENT COUNTRY ORIGIN
Scenario: Attacker uses compromised mail server with invalid DKIM signature
================================================================================

Return-Path: <svc-notify@acmecorp-it.example.com>
Delivered-To: all-staff@acmecorp.com
Received: from mx2.acmecorp.com (mx2.acmecorp.com [203.0.113.11])
        by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS
        id <auto-002>;
        Tue, 15 Oct 2025 14:30:19 -0400
Received: from mx2.acmecorp.com (localhost [127.0.0.1])
        by mx2.acmecorp.com (Postfix) with ESMTP id 2A891F2D03
        for <all-staff@acmecorp.com>;
        Tue, 15 Oct 2025 14:30:18 -0400
Received: from smtp-out.acmecorp-it.example.com (unknown [103.48.216.77])
        by mx2.acmecorp.com (Postfix) with ESMTPS id F8820F2D01
        for <all-staff@acmecorp.com>;
        Tue, 15 Oct 2025 14:30:16 -0400
Received: from web-app01 (internal [10.0.0.44])
        by smtp-out.acmecorp-it.example.com (PHPMailer) with SMTP
        id php-88291;
        Wed, 16 Oct 2025 01:30:12 +0800
Authentication-Results: mx2.acmecorp.com;
        spf=softfail (domain acmecorp-it.example.com does not designate
            103.48.216.77 as permitted sender) smtp.mailfrom=svc-notify@acmecorp-it.example.com;
        dkim=fail (signature verification failed: body hash mismatch)
            header.d=acmecorp-it.example.com header.s=default header.b=kQ7vT1xM;
        dmarc=none (no DMARC record found for acmecorp-it.example.com)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=acmecorp-it.example.com; s=default;
        h=from:to:subject:date:message-id;
        bh=invalidhashAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=;
        b=kQ7vT1xMfakeSignatureDataHereNotRealCryptoOutputXXXXXXXXXXXXXX
          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-Spam-Score: 6.2
X-Spam-Status: Yes, score=6.2 required=5.0 tests=SPF_SOFTFAIL,DKIM_INVALID,
        NO_DMARC,FROM_NOT_INTERNAL,PHPMAILER_USED,TZ_MISMATCH
X-PHP-Originating-Script: 0:mailer.php
From: IT Security Team <security@acmec0rp.com>
Reply-To: helpdesk-acme@outlook.com
To: all-staff@acmecorp.com
Message-ID: <php-88291@smtp-out.acmecorp-it.example.com>
Date: Tue, 15 Oct 2025 14:30:11 -0400
Subject: [ACTION REQUIRED] Mandatory Password Reset — Security Incident
X-Mailer: PHPMailer 6.8.0
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

--- ANALYSIS ---
INDICATORS OF COMPROMISE:

1. DKIM FAIL: Signature present but body hash does not match
   (bh=invalidhash...). The message body was modified after signing,
   or the signature was forged. Either way, integrity is not verified.

2. DKIM DOMAIN: Signed by acmecorp-it.example.com, NOT acmecorp.com.
   This is a lookalike domain the attacker controls.

3. SPF SOFTFAIL: The sending IP 103.48.216.77 is not in the SPF record
   for acmecorp-it.example.com. Geolocation: this IP belongs to a hosting
   provider in Hong Kong (CN region).

4. DMARC MISSING: No DMARC record exists for acmecorp-it.example.com.
   The attacker registered this domain without configuring DMARC, so there
   is no policy to enforce alignment.

5. TIMEZONE DISCREPANCY: The innermost Received header shows +0800 (Asia),
   but the Date header claims -0400 (US Eastern). The server is in a
   different timezone than claimed.

6. X-PHP-Originating-Script: Reveals the email was sent by a PHP script
   (mailer.php), not a legitimate mail client or enterprise mail system.

7. FROM vs ENVELOPE-FROM: Display From is security@acmec0rp.com but
   envelope Return-Path is svc-notify@acmecorp-it.example.com — two
   completely different domains, neither of which is acmecorp.com.

8. REPLY-TO: helpdesk-acme@outlook.com — a free consumer email service,
   not an enterprise helpdesk system.

================================================================================
HEADER SET #3 — MISSING DMARC + ENVELOPE-FROM MISMATCH + SUSPICIOUS RELAY
Scenario: Attacker uses compromised SMTP relay to send fake Microsoft alert
================================================================================

Return-Path: <SRS0=XXXX=RT=micros0ft-365.example.com=alert@bounce.relay-host.example.org>
Delivered-To: rachel.torres@acmecorp.com
Received: from mx1.acmecorp.com (mx1.acmecorp.com [203.0.113.10])
        by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS
        id <auto-003>;
        Fri, 18 Oct 2025 03:15:03 -0400
Received: from mx1.acmecorp.com (localhost [127.0.0.1])
        by mx1.acmecorp.com (Postfix) with ESMTP id 5C920F1E07
        for <rachel.torres@acmecorp.com>;
        Fri, 18 Oct 2025 03:15:02 -0400
Received: from relay-host.example.org (relay-host.example.org [45.77.198.201])
        by mx1.acmecorp.com (Postfix) with ESMTPS id 1D443F1E05
        for <rachel.torres@acmecorp.com>;
        Fri, 18 Oct 2025 03:15:00 -0400
Received: from ses-smtp-out.amazonses.example.com (unknown [177.54.22.89])
        by relay-host.example.org (Exim 4.96) with ESMTP id 1qABcD-00034z-1G
        for <rachel.torres@acmecorp.com>;
        Fri, 18 Oct 2025 08:14:58 +0100
Received: from app-server (unknown [177.54.22.89])
        by ses-smtp-out.amazonses.example.com with SMTP
        id amzn-ses-fake-001;
        Fri, 18 Oct 2025 04:14:55 -0300
Authentication-Results: mx1.acmecorp.com;
        spf=pass (relay-host.example.org is authorized for relay-host.example.org)
            smtp.mailfrom=SRS0=XXXX=RT=micros0ft-365.example.com=alert@bounce.relay-host.example.org;
        dkim=none (no DKIM signature present);
        dmarc=none (no DMARC record found for micros0ft-365.example.com)
X-SES-Outgoing: false
X-Original-From: security-alert@micros0ft-365.example.com
X-Spam-Score: 7.4
X-Spam-Status: Yes, score=7.4 required=5.0 tests=DKIM_MISSING,NO_DMARC,
        FROM_DOMAIN_TYPOSQUAT,SRS_BOUNCE,RELAY_SUSPICIOUS,BRAZIL_ORIGIN,
        NIGHT_DELIVERY,MICROSOFT_IMPERSONATION
From: Microsoft Account Security <security-alert@micros0ft-365.example.com>
Reply-To: security-noreply@micros0ft-365.example.com
To: rachel.torres@acmecorp.com
Message-ID: <amzn-ses-fake-001@ses-smtp-out.amazonses.example.com>
Date: Fri, 18 Oct 2025 03:14:55 -0400
Subject: [ALERT] Unusual sign-in activity detected on your account
X-Mailer: Amazon SES
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

--- ANALYSIS ---
INDICATORS OF COMPROMISE:

1. DMARC MISSING: No DMARC record exists for micros0ft-365.example.com.
   The attacker registered this typosquatting domain specifically to avoid
   DMARC enforcement. Real Microsoft alerts come from microsoft.com, which
   has p=reject DMARC policy.

2. SPF PASS (MISLEADING): SPF passes for relay-host.example.org because
   the envelope-from was rewritten using SRS (Sender Rewriting Scheme).
   This is the RELAY's SPF, not Microsoft's. The SPF check is technically
   valid but meaningless for authentication.

3. DKIM: No DKIM signature at all. Legitimate Microsoft emails carry valid
   DKIM signatures from d=microsoft.com or d=outlook.com.

4. ENVELOPE-FROM vs DISPLAY-FROM:
   - Return-Path: ...@bounce.relay-host.example.org (relay operator)
   - From header: security-alert@micros0ft-365.example.com (fake Microsoft)
   - Real Microsoft: @microsoft.com
   Three entirely different domains involved.

5. ORIGINATING IP CHAIN:
   - 177.54.22.89 — Geolocates to Sao Paulo, Brazil
   - 45.77.198.201 — Geolocates to London, UK (relay host)
   - Neither IP is associated with Microsoft or Amazon SES infrastructure

6. X-MAILER: Claims "Amazon SES" but the sending infrastructure is not
   actual AWS SES (X-SES-Outgoing: false is a fabricated header).
   Real SES messages have verifiable SES headers and DKIM signatures
   from amazonses.com.

7. TIMING: Sent at 03:14 AM recipient local time. Legitimate Microsoft
   security alerts are generated in real-time but this timing combined
   with the Brazilian origin suggests an attacker in a different timezone.

8. MESSAGE-ID: Contains "fake" in the identifier — sloppy attacker
   operational security (not always present, but notable when found).

================================================================================
SUMMARY: KEY HEADER FIELDS TO CHECK
================================================================================

When analyzing suspicious emails, prioritize these header fields:

  1. Authentication-Results  — SPF, DKIM, DMARC pass/fail verdicts
  2. Return-Path             — Envelope-from; compare with display From
  3. Received (full chain)   — Trace originating IP and relay path
  4. From vs Reply-To        — Mismatches indicate redirection to attacker
  5. DKIM-Signature           — Verify signing domain matches From domain
  6. X-Mailer                — Unusual/unexpected mail client or library
  7. Message-ID              — Domain in Message-ID should match sender
  8. Date vs Received times  — Timezone inconsistencies reveal true origin

================================================================================
END OF HEADER SAMPLES
================================================================================
