I am currently analyzing and exploring daily phishing attempts. Some at points, I am unable to definitively verify if this is, in fact, a phishing attempt.
When analyzing phishing attempts, specifically spear phishing, has one ever felt the need for an isolated analysis machine where you can click on links to your leisure and download PUA's?
The process I have undergone is essentially:
- check headers end-to-end,
- if it seems legit move to URL scanners like Virus Total & Symantec URL checker etc.
- if this checks out assume it was never scanned or crawled and try to understand why the end user reported this as phishing etc.
Beyond the typical 100% definitively confirmed phishing attempts where a user utilizes poor grammar, shortened URL's, sketchy URL extensions or sketchy attachments, at what point should one stop putting time and effort into analyzing a phishing attempt?
I understand this question may sway towards an opinion, however I would like to direct the answers towards trying to prevent false negatives. When we have a legitimate email but things still cannot be confirmed and we label it as phishing.
Is it safer to always abide by the "trust no one policy"?