Tools and references
Free tools that support each triage step, and every source cited in this guide.
Check before you use
Use only tools on your organization's approved list. Public services may store, and share, whatever you submit.
Free analysis tools
| Tool | Use it for | Steps |
|---|---|---|
| Microsoft Message Header Analyzer | Reading raw headers in a clean layout | 4 |
| Google Admin Toolbox: Messageheader | Reading raw headers and spotting delivery delays | 4 |
| ICANN Lookup | Finding a domain's registration date and registrar (WHOIS) | 4 |
| urlscan.io | Safely viewing a URL, its redirects, and a screenshot of the page | 5 |
| VirusTotal | Checking the reputation of URLs, domains, and file hashes | 5, 6 |
| ANY.RUN and Hybrid Analysis | Interactive sandboxes for files and URLs | 5, 6 |
| CyberChef | Decoding encoded text and URLs; defanging IOCs | 4 to 6 |
References
- Crocker, D., Hansen, T., & Kucherawy, M. (Eds.). (2011). DomainKeys Identified Mail (DKIM) signatures (RFC 6376). Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc6376
- Federal Bureau of Investigation. (2026). 2025 Internet crime report. Internet Crime Complaint Center. https://www.ic3.gov/
- Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C., Savage, S., & Voelker, G. M. (2025). Understanding the efficacy of phishing training in practice. In 2025 IEEE Symposium on Security and Privacy (pp. 37–54). https://doi.org/10.1109/SP61157.2025.00076
- Kitterman, S. (2014). Sender Policy Framework (SPF) for authorizing use of domains in email, version 1 (RFC 7208). Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc7208
- Kucherawy, M., & Zwicky, E. (Eds.). (2015). Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 7489). Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc7489
- Lain, D., Kostiainen, K., & Čapkun, S. (2022). Phishing in organizations: Findings from a large-scale and long-term study. In 2022 IEEE Symposium on Security and Privacy (pp. 842–859). ETH Zurich Research Collection
- MITRE. (2026). Phishing, technique T1566 (Version 2.7). MITRE ATT&CK. https://attack.mitre.org/techniques/T1566/
- National Institute of Standards and Technology. (n.d.). Phishing. CSRC Glossary. https://csrc.nist.gov/glossary/term/phishing
- Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST SP 800-61 Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
- Steves, M., Greene, K., & Theofanos, M. (2019). A Phish Scale: Rating human phishing message detection difficulty. Workshop on Usable Security and Privacy (USEC) 2019. https://csrc.nist.gov/pubs/conference/2019/02/24/rating-human-phishing-message-detection-difficulty/final
- UC San Diego. (2025). Cybersecurity training programs don’t prevent employees from falling for phishing scams [News release]. https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams
- Verizon. (2026). 2026 data breach investigations report. https://www.verizon.com/business/resources/reports/dbir/