================================================================================ EMAIL HEADER ANALYSIS SAMPLES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY ================================================================================ WARNING: These are fictional headers created for educational purposes. All IPs, domains, and identifiers are fabricated. Analyzing email headers from real phishing without authorization may violate applicable laws. ================================================================================ HEADER SET #1 — SPF FAIL + SPOOFED FROM Scenario: Attacker spoofs CEO's email address from unauthorized mail server ================================================================================ Return-Path: Delivered-To: jennifer.liu@acmecorp.com Received: from mx1.acmecorp.com (mx1.acmecorp.com [203.0.113.10]) by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS id ; Mon, 14 Oct 2025 08:12:41 -0400 Received: from mx1.acmecorp.com (localhost [127.0.0.1]) by mx1.acmecorp.com (Postfix) with ESMTP id 7B3A2F1C01 for ; Mon, 14 Oct 2025 08:12:40 -0400 Received: from mail-relay.example.net (unknown [91.195.240.18]) by mx1.acmecorp.com (Postfix) with ESMTP id 4D1C3F1BFF for ; Mon, 14 Oct 2025 08:12:38 -0400 Received: from localhost (vps-node7.hostprovider.ru [185.176.43.112]) by mail-relay.example.net (Postfix) with ESMTPA id 9E221A034 auth=plain user=relay-user; Mon, 14 Oct 2025 15:12:35 +0300 Authentication-Results: mx1.acmecorp.com; spf=fail (sender IP 91.195.240.18 is not authorized for domain acmec0rp.com) smtp.mailfrom=bounce-3892@mail-relay.example.net; dkim=none (no DKIM signature present); dmarc=fail (p=none, no alignment) header.from=acmec0rp.com X-Spam-Score: 8.7 X-Spam-Status: Yes, score=8.7 required=5.0 tests=SPF_FAIL,DKIM_MISSING, DMARC_FAIL,FROM_DOMAIN_NOVOWEL,RCVD_IN_BRBL,SUSPICIOUS_REPLYTO From: Marcus Webb Reply-To: marcus.webb.ceo@gmail.com To: jennifer.liu@acmecorp.com Message-ID: Date: Mon, 14 Oct 2025 08:12:33 -0400 Subject: Urgent — Confidential Acquisition Wire Transfer X-Mailer: Microsoft Outlook 16.0 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" --- ANALYSIS --- INDICATORS OF COMPROMISE: 1. SPF FAIL: Sending IP 91.195.240.18 (mail-relay.example.net) is NOT in the SPF record for acmec0rp.com. The legitimate acmecorp.com SPF record authorizes only 203.0.113.0/24. This is a different domain entirely. 2. DKIM: No DKIM signature present. Legitimate acmecorp.com emails always carry a valid DKIM signature (selector: s1._domainkey.acmecorp.com). 3. DMARC FAIL: The DMARC policy for acmec0rp.com is p=none (monitor only), meaning the failure is logged but the email is still delivered. Note: this is the LOOKALIKE domain's DMARC, not acmecorp.com's. 4. RETURN-PATH MISMATCH: Return-Path is bounce-3892@mail-relay.example.net, but From header claims marcus.webb@acmec0rp.com. These domains do not match, indicating envelope-from spoofing. 5. ORIGINATING IP: The earliest Received header shows 185.176.43.112, which resolves to vps-node7.hostprovider.ru — a Russian VPS provider. Acme Corporation is US-based. 6. REPLY-TO MISMATCH: Reply-To is a Gmail address (marcus.webb.ceo@gmail.com), not the corporate domain. Replies go to the attacker, not the real CEO. 7. X-MAILER CLAIM: Claims Microsoft Outlook 16.0, but the Received chain shows Postfix on Linux — inconsistent with Outlook sending behavior. ================================================================================ HEADER SET #2 — DKIM MISMATCH + DIFFERENT COUNTRY ORIGIN Scenario: Attacker uses compromised mail server with invalid DKIM signature ================================================================================ Return-Path: Delivered-To: all-staff@acmecorp.com Received: from mx2.acmecorp.com (mx2.acmecorp.com [203.0.113.11]) by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS id ; Tue, 15 Oct 2025 14:30:19 -0400 Received: from mx2.acmecorp.com (localhost [127.0.0.1]) by mx2.acmecorp.com (Postfix) with ESMTP id 2A891F2D03 for ; Tue, 15 Oct 2025 14:30:18 -0400 Received: from smtp-out.acmecorp-it.example.com (unknown [103.48.216.77]) by mx2.acmecorp.com (Postfix) with ESMTPS id F8820F2D01 for ; Tue, 15 Oct 2025 14:30:16 -0400 Received: from web-app01 (internal [10.0.0.44]) by smtp-out.acmecorp-it.example.com (PHPMailer) with SMTP id php-88291; Wed, 16 Oct 2025 01:30:12 +0800 Authentication-Results: mx2.acmecorp.com; spf=softfail (domain acmecorp-it.example.com does not designate 103.48.216.77 as permitted sender) smtp.mailfrom=svc-notify@acmecorp-it.example.com; dkim=fail (signature verification failed: body hash mismatch) header.d=acmecorp-it.example.com header.s=default header.b=kQ7vT1xM; dmarc=none (no DMARC record found for acmecorp-it.example.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=acmecorp-it.example.com; s=default; h=from:to:subject:date:message-id; bh=invalidhashAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=; b=kQ7vT1xMfakeSignatureDataHereNotRealCryptoOutputXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X-Spam-Score: 6.2 X-Spam-Status: Yes, score=6.2 required=5.0 tests=SPF_SOFTFAIL,DKIM_INVALID, NO_DMARC,FROM_NOT_INTERNAL,PHPMAILER_USED,TZ_MISMATCH X-PHP-Originating-Script: 0:mailer.php From: IT Security Team Reply-To: helpdesk-acme@outlook.com To: all-staff@acmecorp.com Message-ID: Date: Tue, 15 Oct 2025 14:30:11 -0400 Subject: [ACTION REQUIRED] Mandatory Password Reset — Security Incident X-Mailer: PHPMailer 6.8.0 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" --- ANALYSIS --- INDICATORS OF COMPROMISE: 1. DKIM FAIL: Signature present but body hash does not match (bh=invalidhash...). The message body was modified after signing, or the signature was forged. Either way, integrity is not verified. 2. DKIM DOMAIN: Signed by acmecorp-it.example.com, NOT acmecorp.com. This is a lookalike domain the attacker controls. 3. SPF SOFTFAIL: The sending IP 103.48.216.77 is not in the SPF record for acmecorp-it.example.com. Geolocation: this IP belongs to a hosting provider in Hong Kong (CN region). 4. DMARC MISSING: No DMARC record exists for acmecorp-it.example.com. The attacker registered this domain without configuring DMARC, so there is no policy to enforce alignment. 5. TIMEZONE DISCREPANCY: The innermost Received header shows +0800 (Asia), but the Date header claims -0400 (US Eastern). The server is in a different timezone than claimed. 6. X-PHP-Originating-Script: Reveals the email was sent by a PHP script (mailer.php), not a legitimate mail client or enterprise mail system. 7. FROM vs ENVELOPE-FROM: Display From is security@acmec0rp.com but envelope Return-Path is svc-notify@acmecorp-it.example.com — two completely different domains, neither of which is acmecorp.com. 8. REPLY-TO: helpdesk-acme@outlook.com — a free consumer email service, not an enterprise helpdesk system. ================================================================================ HEADER SET #3 — MISSING DMARC + ENVELOPE-FROM MISMATCH + SUSPICIOUS RELAY Scenario: Attacker uses compromised SMTP relay to send fake Microsoft alert ================================================================================ Return-Path: Delivered-To: rachel.torres@acmecorp.com Received: from mx1.acmecorp.com (mx1.acmecorp.com [203.0.113.10]) by imap4.acmecorp.com (Cyrus 3.6.1) with LMTPS id ; Fri, 18 Oct 2025 03:15:03 -0400 Received: from mx1.acmecorp.com (localhost [127.0.0.1]) by mx1.acmecorp.com (Postfix) with ESMTP id 5C920F1E07 for ; Fri, 18 Oct 2025 03:15:02 -0400 Received: from relay-host.example.org (relay-host.example.org [45.77.198.201]) by mx1.acmecorp.com (Postfix) with ESMTPS id 1D443F1E05 for ; Fri, 18 Oct 2025 03:15:00 -0400 Received: from ses-smtp-out.amazonses.example.com (unknown [177.54.22.89]) by relay-host.example.org (Exim 4.96) with ESMTP id 1qABcD-00034z-1G for ; Fri, 18 Oct 2025 08:14:58 +0100 Received: from app-server (unknown [177.54.22.89]) by ses-smtp-out.amazonses.example.com with SMTP id amzn-ses-fake-001; Fri, 18 Oct 2025 04:14:55 -0300 Authentication-Results: mx1.acmecorp.com; spf=pass (relay-host.example.org is authorized for relay-host.example.org) smtp.mailfrom=SRS0=XXXX=RT=micros0ft-365.example.com=alert@bounce.relay-host.example.org; dkim=none (no DKIM signature present); dmarc=none (no DMARC record found for micros0ft-365.example.com) X-SES-Outgoing: false X-Original-From: security-alert@micros0ft-365.example.com X-Spam-Score: 7.4 X-Spam-Status: Yes, score=7.4 required=5.0 tests=DKIM_MISSING,NO_DMARC, FROM_DOMAIN_TYPOSQUAT,SRS_BOUNCE,RELAY_SUSPICIOUS,BRAZIL_ORIGIN, NIGHT_DELIVERY,MICROSOFT_IMPERSONATION From: Microsoft Account Security Reply-To: security-noreply@micros0ft-365.example.com To: rachel.torres@acmecorp.com Message-ID: Date: Fri, 18 Oct 2025 03:14:55 -0400 Subject: [ALERT] Unusual sign-in activity detected on your account X-Mailer: Amazon SES MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" --- ANALYSIS --- INDICATORS OF COMPROMISE: 1. DMARC MISSING: No DMARC record exists for micros0ft-365.example.com. The attacker registered this typosquatting domain specifically to avoid DMARC enforcement. Real Microsoft alerts come from microsoft.com, which has p=reject DMARC policy. 2. SPF PASS (MISLEADING): SPF passes for relay-host.example.org because the envelope-from was rewritten using SRS (Sender Rewriting Scheme). This is the RELAY's SPF, not Microsoft's. The SPF check is technically valid but meaningless for authentication. 3. DKIM: No DKIM signature at all. Legitimate Microsoft emails carry valid DKIM signatures from d=microsoft.com or d=outlook.com. 4. ENVELOPE-FROM vs DISPLAY-FROM: - Return-Path: ...@bounce.relay-host.example.org (relay operator) - From header: security-alert@micros0ft-365.example.com (fake Microsoft) - Real Microsoft: @microsoft.com Three entirely different domains involved. 5. ORIGINATING IP CHAIN: - 177.54.22.89 — Geolocates to Sao Paulo, Brazil - 45.77.198.201 — Geolocates to London, UK (relay host) - Neither IP is associated with Microsoft or Amazon SES infrastructure 6. X-MAILER: Claims "Amazon SES" but the sending infrastructure is not actual AWS SES (X-SES-Outgoing: false is a fabricated header). Real SES messages have verifiable SES headers and DKIM signatures from amazonses.com. 7. TIMING: Sent at 03:14 AM recipient local time. Legitimate Microsoft security alerts are generated in real-time but this timing combined with the Brazilian origin suggests an attacker in a different timezone. 8. MESSAGE-ID: Contains "fake" in the identifier — sloppy attacker operational security (not always present, but notable when found). ================================================================================ SUMMARY: KEY HEADER FIELDS TO CHECK ================================================================================ When analyzing suspicious emails, prioritize these header fields: 1. Authentication-Results — SPF, DKIM, DMARC pass/fail verdicts 2. Return-Path — Envelope-from; compare with display From 3. Received (full chain) — Trace originating IP and relay path 4. From vs Reply-To — Mismatches indicate redirection to attacker 5. DKIM-Signature — Verify signing domain matches From domain 6. X-Mailer — Unusual/unexpected mail client or library 7. Message-ID — Domain in Message-ID should match sender 8. Date vs Received times — Timezone inconsistencies reveal true origin ================================================================================ END OF HEADER SAMPLES ================================================================================