# Analyze a suspicious email a user reported

Breaks down a reported email's headers, links, and content into a phishing verdict and clear next steps.

- Topic: Software Development
- Framework: RTF
- Level: Standard
- Tags: Email, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/analyze-a-suspicious-email-a-user-reported

## Prompt

```text
Help me analyze a suspicious email that an employee reported.

**Email headers:** [PASTE full headers]
**Body text:** [PASTE - defang links, e.g. hxxps://example[.]com]
**Links and attachments:** [URLs, file names, types, hashes]
**Who received it:** [one person / a team / many users]
**Did anyone click, reply, open the attachment, or enter credentials?** [YES/NO/UNKNOWN, details]

Analyze:
1. Sender authentication: SPF, DKIM, DMARC results, Return-Path vs. From, Reply-To mismatches, and the sending infrastructure.
2. Lookalike domains, display-name spoofing, or a compromised legitimate account.
3. Social engineering cues: urgency, payment or credential requests, unusual tone, timing.
4. Link and attachment risk: where links really point, redirects, file types that can run code.
5. Verdict: phishing / spam / legitimate / unclear, with confidence.

Then give me the response actions, scaled to what happened:
- No interaction: block sender or domain, search and purge similar messages, update filters.
- Clicked or entered credentials: reset password, revoke sessions and tokens, check MFA changes and inbox rules, review sign-ins.
- Opened attachment: isolate and scan the device, check for persistence.

Rules: do not visit the links or open attachments yourself, and tell me to use a sandbox for detonation. Do not claim a domain or IP is malicious without data I provided; suggest which reputation sources to check.

Return: verdict summary, evidence table (Indicator | Finding | Risk), response checklist, and a list of IOCs to block.
```

## What to fill in

- PASTE full headers
- PASTE - defang links, e.g. hxxps://example[.
- URLs, file names, types, hashes
- one person / a team / many users
- YES/NO/UNKNOWN, details

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.