Suspicious Email Artifacts (Email / Web / File)

Goal

Collect the key artifacts from a suspicious email (without clicking links or opening attachments) so you can report, block, or escalate with evidence.

Quick Workflow

1. In the mail client: note From, Subject, Date, attachment name, and copy the real URL (not just the link text).
2. Save/export the message as .eml and open it in a text editor.
3. In the .eml: capture From:, To:, Subject:, Date:.
4. Find sender IP (X-Sender-IP or Received:) → do reverse DNS / WHOIS.
5. Search for http / https → record full URL + domain.
6. Save attachment (don’t open) → record file size + hashes (SHA256, optional MD5/SHA1).

Key Commands

Task	Windows Command	Linux Equivalent	What to Look For
Reverse DNS (PTR) for sender IP	nslookup 40.92.90.99	dig -x 40.92.90.99 +short or host 40.92.90.99	Hostname/owner clue (e.g., ends in outlook.com)
WHOIS IP ownership	Use a web WHOIS tool (DomainTools/ARIN/RIPE)	whois 40.92.90.99	Org name / ASN / netblock
SHA256 hash of attachment	Get-FileHash .\terms.pdf	sha256sum terms.pdf	SHA256 to search/block/report
MD5 hash (optional)	Get-FileHash .\terms.pdf -Algorithm MD5	md5sum terms.pdf	Legacy hash (sometimes requested)
SHA1 hash (optional)	Get-FileHash .\terms.pdf -Algorithm SHA1	sha1sum terms.pdf	Legacy hash (sometimes requested)
Alt hashing (if PS blocked)	certutil -hashfile .\terms.pdf SHA256	sha256sum terms.pdf	Same SHA256 goal

Quick Examples

# Hash the attachment (DO NOT open it)
Get-FileHash .\terms.pdf
Get-FileHash .\terms.pdf -Algorithm MD5; Get-FileHash .\terms.pdf -Algorithm SHA1

# Reverse DNS for sender IP
nslookup 40.92.90.99

# Linux equivalents
sha256sum terms.pdf
dig -x 40.92.90.99 +short

What to Check

• Email red flags: generic greeting (“tax payer”), weird currency formatting, dodgy footer, poor styling.
• In .eml headers: From:, To:, Subject:, Date:, X-Sender-IP: (or sender IP in Received:).
• URLs: full https://... link (domain + path).
• Attachment: file name + file size + hashes (SHA256 first).

What to Do Next

• If URL/domain looks suspicious: report/escalate and block it (email/web filtering) + search for similar emails.
• If attachment hashes are suspicious/unknown: escalate hashes (and file via approved process) and hunt in EDR for that hash.
• If sender IP maps to a major provider (e.g., Outlook): treat it as “sent via that provider,” not “safe”—still escalate with URL + hashes.