Chapter 01
Email forensics
- ✓SPF, DKIM, DMARC — what failed and why it still landed
- ✓Authentication-Results & Received chains
- ✓X-headers that reveal bulk senders vs targeted BEC
← All guides
🎣 Blue team · 15+ pages
Stop treating phishing as 'user clicked bad link.' Start investigating like it matters.
Email headers decoded line by line. BEC vs bulk vs AiTM. Device code phishing. Evilginx-style sessions. What to log, what to block, and what to tell leadership — in plain English.
“I wrote this after one too many 'phishing closed — user educated' tickets that were actually session hijacks. Your team deserves better language and better decisions.”— Rishav Bhardwaj
Why you need this — honestly
- Most phishing training stops at 'check the URL.' Real attacks bypass MFA and look perfect in the inbox.
- SOC tiers escalate too late because nobody taught header analysis properly.
- You want scripts and checklists you can use on the next ticket.
What's inside
Written in plain language. No jargon for the sake of jargon. Every section ends with something you can do, not just read.
Chapter 02
Modern attack types (2025–2026)
- ✓Adversary-in-the-Middle (AiTM) & token theft
- ✓Device code / OAuth consent phishing
- ✓QR phishing & HTML smuggling at a practical level
Chapter 03
Hands-on workflow
- ✓Step-by-step header worksheet
- ✓Sandbox vs live kit analysis
- ✓Escalation template for IR and identity teams
Perfect if you are…
SOC analystsIR juniorsEmail security admins
Related guides
Pair Deep Phishing Analysis with these — each is a separate instant-download PDF by Rishav Bhardwaj.
Malware Analysis Bible
Static, dynamic, behavioral — with a lab mindset that sticks.
View guide →SIEM Detection Rules & Use Cases
High-signal detections, logic, and tuning notes — not noise.
View guide →The Cyber Roadmap
17 chapters — networking to SIEM, EDR, GRC, IR, and your first role.
View guide →SOC Analyst Interview Bible
105+ questions with full answers — basic, intermediate & advanced.
View guide →
How to learn phishing analysis — what to do on the next email ticket
Learning phishing analysis means reading headers, understanding authentication failures, and knowing when an alert is session hijack — not just marking ‘user trained.’ This guide teaches the workflow SOC leads expect.
- Decode Authentication-Results and Received chains line by line
- Tell bulk spam, targeted BEC, and AiTM/token theft apart quickly
- Use a repeatable header worksheet and escalation template
- Connect findings to identity, IR, and management comms
Common questions
- How do I learn phishing analysis for SOC work?
- Practice header analysis on real samples (safely), learn SPF/DKIM/DMARC failures, and walk through modern attacks like device-code and AiTM. This PDF gives checklists and language for tier-1 through tier-2 escalation.
- What should I do first when analyzing a phishing email?
- Preserve headers, identify sending path vs displayed From, check auth results, extract URLs/attachments without clicking live, and search for spread — the guide’s workflow section orders these steps.
Instant PDF download
Deep Phishing Analysis
$10.82
15+ pages · 2–3 hours · one-time purchase
International checkout
After you continue to payment, on the Cashfree page please select PayPal (scroll to International Walletif you don't see it).
Prices on this site are in USD. Cashfree may show the equivalent in ₹ — that is normal; PayPal lets you pay from outside India.
✓ 7-day money-back guarantee · instant PDF delivery · no subscription
847 professionals already downloaded this
Want all 7 guides? Complete bundle for $31.3 →
Want live guidance? Book a 1-on-1 with me →
About me
Rishav Bhardwaj — cybersecurity practitioner & author of Cyber Rishav
I've trained 200+ analysts, built blue-team programs inside real enterprises, and still sit in the work — SOC triage, cloud risk, GRC, and IR. These guides are the same structured thinking I use in programs and 1-on-1s, written so you can act this week, not someday.
CISSPCCSKSecurity+CEHISO 27001
Rishav Bhardwaj
Cybersecurity practitioner · Blue team
200+
Analysts coached
10K+
Enterprise seats in IR programs
7
Deep-dive guides
Every guide in this library is something I use when coaching analysts and building programs — not content farm filler. If it does not help you act this week, it does not ship.