It's 2:47 AM when a SOC analyst's phone buzzes. A finance employee just wired $84,000 to a "vendor" — except the vendor never sent that email.
This is where the real work begins. Not the panic, not the wire recall calls — the investigation.
Who owns that email address? Has it been used anywhere else? Is it tied to a known breach, a fake profile, or a pattern of prior fraud?
The Investigation Workflow
Tracing an email back to a real attacker in 2026 follows a fairly repeatable process:
- Header analysis — check the raw headers (not the display name) to see the real sending mailbox, originating IP, and SPF/DKIM/DMARC results
- Domain infrastructure check — inspect mail server records for missing authentication, a common spoofing giveaway
- Breach and reputation lookup — check the email against known breach databases and reputation scoring
- Digital footprint expansion — see which platforms the email is registered on, often revealing reused identities
- Identity correlation — cross-reference any surfaced usernames across other platforms
- Automation for scale — for larger cases, this can be run through automated OSINT frameworks in one pass
This is the same approach used by SOC analysts, DFIR responders, and OSINT researchers investigating real business email compromise (BEC) cases.
I wrote a full breakdown of this workflow, including the specific free tools used at each step:
👉 Read the full investigation guide
Originally published on xpert4cyber.com
Top comments (0)