# Extract headers from EML (Linux)
grep -E "^(Received|From|Return-Path|Authentication-Results|DKIM|SPF|X-Originating)" suspicious.eml

# Parse with Python if needed
python3 -c "
import email, sys
msg = email.message_from_file(open('suspicious.eml'))
for k,v in msg.items(): print(f'{k}: {v}')
"

# Defang URLs in bash
echo "https://evil.com/login" | sed 's/https/hxxps/g; s/\./[.]/g'
# → hxxps://evil[.]com/login

# Extract all URLs from EML
grep -oP 'https?://[^\s"<>]+' suspicious.eml | sort -u

# Extract IPs from headers
grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' suspicious.eml | sort -u

# Extract domains
grep -oP '(?<=@)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' suspicious.eml | sort -u

# VirusTotal hash lookup (no upload needed)
VT_KEY="your_api_key"
curl -s "https://www.virustotal.com/api/v3/files/SHA256_HASH" \
  -H "x-apikey: $VT_KEY" | python3 -m json.tool | grep -E "malicious|suspicious|harmless"

# AbuseIPDB check
ABUSE_KEY="your_api_key"
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=185.220.x.x&maxAgeInDays=90" \
  -H "Key: $ABUSE_KEY" | python3 -m json.tool | grep -E "abuseConfidenceScore|totalReports"

# URLScan.io submission and result
curl -s -X POST "https://urlscan.io/api/v1/scan/" \
  -H "API-Key: your_urlscan_key" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://suspicious-url.com","visibility":"private"}'

# PhishTank URL check
curl -s "https://checkurl.phishtank.com/checkurl/" \
  -d "url=https%3A%2F%2Fsuspicious-url.com&format=json&app_key=your_key"

# Get file type without executing
file attachment.pdf
file suspicious_doc.docx

# Hash the file
sha256sum attachment.pdf

# Extract strings (look for URLs, IPs, registry keys, suspicious keywords)
strings -n 8 attachment.pdf | grep -E "http|powershell|cmd|WScript|Download"

# Check for macros in Office documents
pip install oletools --break-system-packages
olevba suspicious.docx
mraptor suspicious.docx

# PDF analysis
pip install peepdf --break-system-packages
peepdf -f attachment.pdf

# Basic network capture during detonation (separate machine)
sudo tcpdump -i eth0 -w detonation_capture.pcap &
# Open the file in the isolated VM
# After detonation:
kill %1
# Analyze with Zeek or Wireshark
zeek -r detonation_capture.pcap

# Check domain age and registration
whois suspicious-domain.com | grep -E "Creation|Registrar|Updated"

# Check DNS records
dig suspicious-domain.com A
dig suspicious-domain.com MX
dig suspicious-domain.com TXT  # Check for SPF record on phishing domain

# Check certificate details
echo | openssl s_client -connect suspicious-domain.com:443 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

# Full domain profile
whois evil-login-page.com

# All DNS records
dig any evil-login-page.com

# Reverse DNS on suspicious IP
dig -x 185.220.x.x

# Check if domain is on blocklists via MxToolbox
# https://mxtoolbox.com/blacklists.aspx

# Check SPF record
dig TXT yourdomain.com | grep spf

# Check DMARC record
dig TXT _dmarc.yourdomain.com

# Check DKIM selector (replace 'selector1' with your actual selector)
dig TXT selector1._domainkey.yourdomain.com

# Test via MxToolbox
# https://mxtoolbox.com/spf.aspx
# https://mxtoolbox.com/dmarc.aspx