Analyzes email headers to detect phishing via Received chains, SPF/DKIM/DMARC failures, IP origins, and routing anomalies using Python scripts and tools like MXToolbox.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
电子邮件头包含关键元数据，能够揭示邮件的真实来源、路由路径和身份验证状态。分析这些头字段是识别钓鱼尝试、验证发件人真实性和收集威胁情报的基础技能。本技能涵盖使用手动技术和自动化工具对电子邮件头进行系统性提取和解读。
Analyzes raw email headers for phishing investigations: parses Received chains, key fields, verifies SPF/DKIM/DMARC to detect forgery and trace sources.
Analyzes email headers for phishing by extracting/parsing raw headers, tracing delivery paths, and validating SPF/DKIM/DMARC to detect spoofing.
Parse and analyze email headers to trace phishing origins, verify sender authenticity, and detect spoofing via SPF, DKIM, DMARC validation. For incident response and forensics.
Share bugs, ideas, or general feedback.
电子邮件头包含关键元数据，能够揭示邮件的真实来源、路由路径和身份验证状态。分析这些头字段是识别钓鱼尝试、验证发件人真实性和收集威胁情报的基础技能。本技能涵盖使用手动技术和自动化工具对电子邮件头进行系统性提取和解读。
From 和 Return-Path 域名不匹配Authentication-Results 中 SPF/DKIM/DMARC 验证失败Received 链中出现陌生的中继服务器X-Originating-IP 来自意外的地理位置Message-IDX-Mailer 值（例如群发邮件工具）Gmail: 打开邮件 -> 三点菜单 -> "显示原始邮件"
Outlook: 打开邮件 -> 文件 -> 属性 -> Internet 头
Thunderbird: 查看 -> 邮件源代码（Ctrl+U）
使用 scripts/process.py 脚本自动完成头字段分析，包括 IP 地理定位、身份验证验证和异常检测。
Received 头字段