Lab 2 — Phishing Forensics

SPF

Sender Policy Framework — a DNS record listing which mail servers may send for a domain.

DKIM

DomainKeys Identified Mail — a cryptographic signature proving the message was not altered and came from the domain.

DMARC

A policy telling receivers to quarantine or reject mail that fails SPF and DKIM alignment.

Homoglyph

A character from another alphabet that looks identical to a Latin letter, used to fake domains.

Spear phishing

A targeted phish using real details about you, your school or your role.

Work top to bottom through the evidence in this message and give it a risk score.

1. 11. From: From: "IT Helpdesk" <it-support@sch00l-portal-secure.com> — the display name is friendly, the domain is not the school's.
2. 22. Return-Path: Return-Path: bounce@mailer-73.ru — bounces go somewhere completely different. Alignment failure.
3. 33. Authentication-Results: spf=fail dkim=none dmarc=fail — the domain owner never authorised this server.
4. 44. The link: The text says https://portal.school.edu but the href is https://sch00l-portal-secure.com/login?u=tmurphy — the real domain is before the first single slash.
5. 55. The pressure: 'Your account will be deleted within 4 hours.' Urgency plus a deadline is the classic social-engineering lever.
6. 66. Verdict: Six indicators. Report it, do not click, and warn colleagues — spear phishing arrives in waves.

pythonfrom urllib.parse import urlparse

links = [
    "https://portal.school.edu.sch00l-portal-secure.com/login",
    "https://school.edu/login",
    "http://192.168.44.9/portal/login",
]

for url in links:
    host = urlparse(url).hostname or ""
    registrable = ".".join(host.split(".")[-2:])
    print(host, "->", registrable)

Only the last two labels of the hostname matter. Everything to the left can be faked by the attacker.

Practise the real technique in a fully simulated environment — no live systems, no real data, nothing leaves your browser.