CYBERSECURITY
Phishing Investigation Guide
A safe, analyst-oriented workflow for evaluating a reported suspicious email without treating every message as malicious.
Updated 28 October 2026 · Original TechLoomix learning examples. Fictional cases are labeled; no production changes are required.
Treat the report as evidence
A suspicious message is a lead to investigate, not proof that an account is compromised. Record the reporting time, affected mailbox, message identifier if available, reported action and business impact. Use the organization’s reporting and evidence-handling process. Do not open a suspicious attachment or follow a live link simply to see what happens.
Worked case: a fake document-share request
A fictional employee reports an unexpected document invitation. The display name resembles a known supplier, but the sender and destination differ from the expected service. Ask whether the employee only received it, clicked it, entered credentials or approved a prompt. These are different exposure levels and should produce different escalation detail. Verify the supposed request through a known independent contact path.
Separate observations from conclusions
“The URL host differs from the supplier’s usual domain” is an observation. “The supplier has been hacked” is a conclusion not established by that observation. Preserve message details and timestamps using approved tooling. Authentication results, sender reputation and mailbox history provide context; no single indicator should replace the full investigation.
Escalation that helps the responder
Report who was affected, what happened, when, the message evidence, user actions and any endpoint or identity alerts already observed. If credentials were entered or an MFA approval occurred, escalate promptly through the security process. Account containment, session revocation and endpoint isolation belong to authorized responders following their runbooks; do not improvise destructive actions.
Paper practice and answer checkpoint
Write three versions of the same report: unread message, clicked link without entry, and credential submission. For each, identify the missing fact, the safe next observation and the authorized owner. A strong answer preserves evidence, avoids further exposure and states uncertainty. Close the exercise with user communication and an explicit validation step rather than “blocked sender, resolved.”
Technical references
Continue with a practical exercise
Download the free readiness checklist or browse the learning library. Use the next resource to answer one specific gap in your evidence.