Trace suspicious emails and spot sender spoofing.
Investigates suspicious emails to trace their origin and identify sender spoofing through header and authentication analysis.
When to use it
Use when investigating suspected phishing, verifying sender authenticity, responding to a phishing incident, or tracing suspicious email delivery.
Give it a suspicious email; it returns an analysis report covering the delivery path, authentication results, phishing indicators, and risk level.
What you provide
Requires Python with email parsing libraries; the workflow invokes python3.
Uses dig to query SPF, DKIM, and DMARC DNS records.
This skill
/cases/case-2024-001/email/attachments/
Saves attachments and overwrites matching files (irreversible)
VirusTotal
Checks domain and attachment reputation