Анализ заголовков email для расследования фишинга

★ 8.4 · security

analyzing-email-headers-for-phishing-investigation is a Claude Code skill that parses and analyzes email headers to trace the true origin of phishing messages and detect sender spoofing. It processes the Received chain, Return-Path, and Message-ID fields, then validates SPF, DKIM, and DMARC results to confirm or rule out domain forgery. The workflow covers extracting raw headers from EML and PST files using Python email libraries and pypff, running DNS lookups with dig for SPF and DMARC records, and performing programmatic SPF checks via pyspf against the sending IP. Designed for SOC analysts and incident responders who need to triage reported emails, map the relay delivery path, or determine whether a user interacted with a spoofed message during an active phishing investigation.