In this Challenge Lab, you will perform header analysis of a suspicious email. First, you will perform an email address verification check by using centralops.net. Next, you will attempt to discover an association between the email address discovered by the header analysis of the suspicious email by using four tools and services on the OSINT Framework web site, including That’sThem, VerifyEmail, Email Reputation, and Have I Been Pwned. Next, you will analyze the suspicious email by using MX Toolbox, and then you will determine who the domain name of the suspicious email address is registered to by using WHOIS. Finally, you will perform a number registration lookup of the suspicious email by using the American Registry for Internet Numbers, and then you will perform a location lookup of the email address by using IP2LOCATION. Note: Once you begin the Challenge Lab, you will not be able to pause, save, or exit and then return to your Challenge Lab. Please ensure that you have set aside enough time to complete the Challenge Lab before you start.
Learning Objectives
In this Challenge Lab, you will perform header analysis of a suspicious email. First, you will perform an email address verification check by using centralops.net. Next, you will attempt to discover an association between the email address discovered by the header analysis of the suspicious email by using four tools and services on the OSINT Framework web site, including That’sThem, VerifyEmail, Email Reputation, and Have I Been Pwned. Next, you will analyze the suspicious email by using MX Toolbox, and then you will determine who the domain name of the suspicious email address is registered to by using WHOIS. Finally, you will perform a number registration lookup of the suspicious email by using the American Registry for Internet Numbers, and then you will perform a location lookup of the email address by using IP2LOCATION. Note: Once you begin the Challenge Lab, you will not be able to pause, save, or exit and then return to your Challenge Lab. Please ensure that you have set aside enough time to complete the Challenge Lab before you start.
Framework Connections
Specialty Areas
- Cybersecurity Management
Feedback
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.