Analyze a suspicious email a user reported

Help me analyze a suspicious email that an employee reported. Email headers: [PASTE full headers] Body text: [PASTE - defang links, e.g. hxxps://example[.]com] Links and attachments: [URLs, file names, types, hashes] Who received it: [one person / a team / many users] Did anyone click, reply, open the attachment, or enter credentials? [YES/NO/UNKNOWN, details] Analyze: 1. Sender authentication: SPF, DKIM, DMARC results, Return-Path vs. From, Reply-To mismatches, and the sending infrastructure. 2. Lookalike domains, display-name spoofing, or a compromised legitimate account. 3. Social engineering cues: urgency, payment or credential requests, unusual tone, timing. 4. Link and attachment risk: where links really point, redirects, file types that can run code. 5. Verdict: phishing / spam / legitimate / unclear, with confidence. Then give me the response actions, scaled to what happened: - No interaction: block sender or domain, search and purge similar messages, update filters. - Clicked or entered credentials: reset password, revoke sessions and tokens, check MFA changes and inbox rules, review sign-ins. - Opened attachment: isolate and scan the device, check for persistence. Rules: do not visit the links or open attachments yourself, and tell me to use a sandbox for detonation. Do not claim a domain or IP is malicious without data I provided; suggest which reputation sources to check. Return: verdict summary, evidence table (Indicator | Finding | Risk), response checklist, and a list of IOCs to block.