Worked example

Here is one reported email traced through all ten steps. The company, people, and domains are invented, and every link is defanged so it cannot be clicked.

The reported email

Reported by Dana R., Accounts Payable, at 9:14 a.m.

From: "IT Help Desk" <helpdesk@northwind-it-support[.]com>
Reply-To: <nw.helpdesk.verify@gmail[.]com>
To: dana.r@northwindlogistics[.]com
Subject: ACTION REQUIRED: Your password expires in 2 hours

Dear Employee,

Our records show your Microsoft 365 password will expire today.
To avoid losing access to email and Teams, verify your account now:

   [ Keep My Password ]  ->  hxxps://northwind-login.portal-verify[.]top/m365

If you do not verify within 2 hours your account will be locked.

Thank you,
IT Help Desk

Walking through the steps

Analyst findings for each triage step
Step	What the analyst checks	What they find	Verdict
2. Get the original	Pulls the .eml from the email security console	Full headers available	Ready to analyze
3. Visual review	Display name vs. address; Reply-To; request; pressure	“IT Help Desk” uses an outside domain. Reply-To is a free Gmail account. A 2-hour deadline and a lockout threat.	Red flags
4. Headers	SPF, DKIM, DMARC; domain age	SPF passes for `northwind-it-support[.]com`, but that is not the company's domain. WHOIS shows it was registered 3 days ago.	Look-alike domain
5. Links	URL reputation; sandbox view	The button leads to a fake Microsoft 365 login page on a `.top` domain	Credential harvesting
6. Attachments	Hash lookup	No attachments	Not applicable
7. The request	Would IT really send this?	The real help desk never sends password links by email	Not legitimate
8. Scope	Mail-log and proxy-log search	37 employees received it; proxy logs show 2 visited the URL	Wider campaign
9. Classify and respond	Decision and escalation	Malicious. Email purged from all inboxes; domain and URL blocked. The 2 users who visited were escalated to incident response for password resets and session revocation.	Escalated
10. Document	Ticket notes; reply to reporter	Ticket completed with the template; Dana thanked	Closed

Lesson from this example

SPF passing did not make the email safe. It only proved that the attacker's own domain authorized the attacker's server. Always ask which domain passed.