Phishing Email Analysis Report
Section 1 — Email Description and Artefacts Collected
Header Artefacts
| Field | Value |
|---|---|
| Sending Address | [sender@domain.com] |
| Reply-To | [replyto@domain.com — if different from sender] |
| Subject Line | [Subject of the email] |
| Date and Time | [DD Month YYYY, HH:MM AM/PM] |
| Recipient(s) | [user1@org.com, user2@org.com, …] |
| Sending Server IP | [x.x.x.x] |
| Reverse DNS | [rDNS result — provider name] |
Web Artefacts (if applicable)
| Field | Value |
|---|---|
| Full URL (sanitized) | hxxps://malicious[.]domain/path/page.php? |
| Root Domain | hxxps://malicious[.]domain |
Attachment Artefacts (if applicable)
| Field | Value |
|---|---|
| File Name | [filename.ext] |
| MD5 Hash | [hash value] |
Email Description
[Describe what the email claims to be, who it impersonates, what action it asks the recipient to take, and any social engineering techniques used — urgency, fear, authority, branding, etc.]
Section 2 — Artefact Analysis
Email gateway check [Have any recipients replied to the sender? Check outbound emails to the sending address.]
Reverse DNS analysis [Does the sending server IP match the claimed sender domain? Confirm the real origin of the email.]
URL / domain analysis (URL2PNG, VirusTotal) [What does the URL host? Is the domain flagged as malicious? Any typosquatting or subdomain tricks used to appear legitimate?]
SIEM / EDR check [Have any employees connected to the malicious domain or executed the attachment? Any alerts triggered?]
Attachment analysis (if applicable) [MD5 hash lookup on VirusTotal. What type of malware? Has it executed on any machine?]
Section 3 — Suggested Defensive Measures
Sender Block — Email Gateway
[Explain why blocking the sender address is appropriate. State there is no negative business impact. If blocking the full domain is excessive (only one mailbox observed), justify blocking only the address and not the domain.]
✅ Sender Block (Email Gateway) “[sender@domain.com]” on [DD Month YYYY] at [HH:MM AM/PM] by [Analyst Name]
Domain Block — Web Proxy
[Explain why the domain is malicious based on VirusTotal and URL analysis. Confirm there is no business justification for employees to visit it. Always block the root domain, not just the full URL path.]
✅ Domain Block (Web Proxy) “hxxps://malicious[.]domain” on [DD Month YYYY] at [HH:MM AM/PM] by [Analyst Name]
Hash Block — EDR (if applicable)
[Block the file hash on EDR/AV to prevent execution on any machine that may have received the attachment.]
✅ Hash Block (EDR) “[MD5 hash]” on [DD Month YYYY] at [HH:MM AM/PM] by [Analyst Name]
Checklist
Section 1
- Sending address noted
- Reply-to noted (if different)
- Subject line noted
- Date and time noted
- All recipients listed
- Sending server IP noted
- Reverse DNS noted
- Full URL sanitized (hxxps, [.])
- Root domain listed separately
- File name and MD5 hash noted (if attachment)
Section 2
- Email gateway checked (any replies?)
- Reverse DNS confirmed
- URL analyzed (URL2PNG)
- Domain checked on VirusTotal
- SIEM / EDR checked (any clicks or executions?)
- Hash checked on VirusTotal (if attachment)
Section 3
- Sender block justified and logged
- Domain block justified (root domain, not subdomain)
- Hash block logged (if attachment)
- Each block includes: type, value, date, time, analyst name