I am currently analyzing and exploring daily phishing attempts. Some at points, I am unable to definitively verify if this is, in fact, a phishing attempt.

When analyzing phishing attempts, specifically spear phishing, has one ever felt the need for an isolated analysis machine where you can click on links to your leisure and download PUA's?

The process I have undergone is essentially:

  1. check headers end-to-end,
  2. if it seems legit move to URL scanners like Virus Total & Symantec URL checker etc.
  3. if this checks out assume it was never scanned or crawled and try to understand why the end user reported this as phishing etc.

Beyond the typical 100% definitively confirmed phishing attempts where a user utilizes poor grammar, shortened URL's, sketchy URL extensions or sketchy attachments, at what point should one stop putting time and effort into analyzing a phishing attempt?

I understand this question may sway towards an opinion, however I would like to direct the answers towards trying to prevent false negatives. When we have a legitimate email but things still cannot be confirmed and we label it as phishing.

Is it safer to always abide by the "trust no one policy"?

  • 1
    "At what point should one stop putting time and effort into analyzing a phishing attempt?" - What and who are you protecting? Do you have high value sensitive data and a staff vulnerable to phishing? The effort needed depends on your threat model
    – iainpb
    Mar 2, 2018 at 9:05
  • Whether you need the freedom to click links and download stuff depends on what your goals are and if doing so meets those goals.
    – schroeder
    Mar 2, 2018 at 10:27
  • "has one ever felt the need for an isolated analysis machine where you can click on links to your leisure and download PUA's?" Just to answer this question directly, OP - Yes. I use such a tool almost daily. Mostly because my boss is convinced that we're targeted by nation states (we're not.) but "Yes.", all the same. Mar 2, 2018 at 20:10
  • @Adonalsium: This is effectively what I was thinking most organizations or departments followed. With phishing in mind and PUA's in general I have lately been finding myself wanting to justify an isolated analysis machine.
    – Mr.J
    Mar 2, 2018 at 23:51
  • @Mr.J some vendors offer an online sandbox, might be easier or you might have one already available through your endpoint protection or email protection vendor. I use the MCAT from CIS but that's restricted to governments only, so I can't give any real recommendation. Mar 4, 2018 at 15:20

1 Answer 1


I'm concerned that you seem to only have 2 categories:

  • confirmed legitimate
  • phishing

You need at least a 3rd category: "unknown".

You also do not describe how you define "phishing" but it looks like you have a very broad definition. Phishing is still a very technical term with specific markers. You might want to consider using the category of "social engineering" to avoid locking your analysis into an unhelpful model.

For instance, what about the first of a string of emails to engage in a relationship with a recipient? The email can come from a legitimate source and not have attachments or links, just a simple start to a seemingly benign conversation. The actual "phishing" happens later. How do you analyse that first email? How do you classify it? The analysis can come up clean, but you cannot decide if it is phishing (yet) or legitimate business communication. It has to fall into a 3rd category to allow the communication but to alert users to remain on guard.

This "unknown" category gives you the freedom to conclude the analysis without wasting time trying to confirm something that can never be confirmed and tagging the email in this way still informs the user who reported it. This is different from "trust no one", but rather "maintain healthy levels of suspicion until trust is warranted" which is a much more helpful message to users and avoids false negatives.

  • 1
    This is a great answer to a broad question. Effectively I have been operating under three buckets as you state. (1) Confirmed Phish, (2) confirmed legit, and (3) unknown - where I advise user to contact sender to verify. I usually only do this step if the forwarded suspected email was sent because "we conduct business with xyz but have not had any engagements as of lately". But I would like to ultimately try and reduce my (3) unknowns and more effectively gear them towards "confirmed" or "not confirmed". This may ultimately be locking myself into an unhelpful model as you state.
    – Mr.J
    Mar 2, 2018 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .