← Phishing Email Triage: From Message Evidence to Containment
1. Preserve and Read the Message
Start with Safe Handling and an Investigation Question Reconstruct Routing and Sender Identities
2. Authenticate and Analyze the Content
Interpret SPF, DKIM, DMARC, and Alignment Analyze URLs, Redirects, and Landing Evidence
3. Scope, Decide, and Contain
Triage Attachments Without Turning Analysis into Execution Scope Exposure, Choose a Disposition, and Write the Case
2. Authenticate and Analyze the Content

Analyze URLs, Redirects, and Landing Evidence

Parse destinations, expand the investigation through approved passive evidence, and distinguish suspicious appearance from observed behavior.

In this lesson, you will learn to:

  • Parse and normalize a URL without visiting it.
  • Evaluate redirect and landing evidence while preserving the distinction between observation and inference.

Analyze URLs, Redirects, and Landing Evidence

Builds a safe URL workflow covering canonical components, redirect chains, domain context, credentials lures, and the limits of reputation services.

Parse before you enrich

Extract the exact href or text destination from the preserved message using approved tooling. Separate scheme, user-information, hostname, port, path, query, and fragment. The hostname, not a familiar word elsewhere in the string, determines the network destination. Decode percent-encoding in a working copy, preserve the original, convert internationalized labels for comparison when tooling supports it, and note non-default ports. Remove neither query values nor fragments until deciding whether they contain victim identifiers or evidence needed for scoping.

Compare the registered domain, subdomains, path wording, and displayed link text. A long URL, a recently observed domain, a URL shortener, or an IP-literal host can increase concern but is not independently malicious. Likewise, HTTPS protects transport to the selected server; it does not establish that the server is trustworthy. Check whether the domain is expected for the claimed business workflow, whether the message asks for credentials or payment, and whether other recipients saw the same destination or a per-recipient variant.

A URL is a sequence of security-relevant fieldsScheme, authority, hostname, port, path, query, and fragment are separated so the real destination is not confused with display text.FIELD GUIDEA URL is a sequence of security-relevant fieldsSchemeFIELD 1HostnameFIELD 2PortFIELD 3PathFIELD 4Query andfragmentFIELD 5URL ANATOMY
A URL is a sequence of security-relevant fields — Scheme, authority, hostname, port, path, query, and fragment are separated so the real destination is not confused with display text.

Follow evidence through redirects without live-clicking

Use mail-security rewrite data, approved reputation sources, passive DNS, certificate transparency, and an isolated browser or detonation service only within policy. Record the time of each lookup because destinations and verdicts change. A redirect chain can pass through a legitimate tracking service before reaching attacker infrastructure; blocking the shared service may cause disproportionate impact. Capture every resolved hop, status, final host, page purpose, and observed credential or download behavior without entering real credentials.

Treat public submission services as disclosure destinations. Do not upload a private URL containing a tenant name, document identifier, user address, or access token unless policy permits it. If the URL is already blocked or no longer resolves, that absence does not erase the message’s risk at delivery time. Combine destination evidence with authentication, content, recipient interaction, and endpoint or identity telemetry. State “the isolated analysis observed a credential collection page at time X,” not “the domain is always malicious.”

Redirect evidence branches before a final actionA short link may reach tracking, authentication, download, or blocked destinations, each requiring a different decision.FIELD GUIDERedirect evidence branches before a final actionExtracted URLShared trackingCredential pageFile downloadBlocked or deadREDIRECT TREE
Redirect evidence branches before a final action — A short link may reach tracking, authentication, download, or blocked destinations, each requiring a different decision.

Resources

  • Microsoft Defender email entity page — Use the official field reference for message details, authentication, URL, attachment, and delivery evidence available during an email investigation.
← Previous: Interpret SPF, DKIM, DMARC, and Alignment Next: Triage Attachments Without Turning Analysis into Execution →