Overview
Sender anomalies are the tell-tale signs that a sender isn't who they claim. This lesson covers detecting them.
Learning objectives
- Identify common sender anomalies in phishing.
- Explain spoofing and lookalike techniques.
- Connect sender analysis to phishing detection.
Core concept
Sender anomalies are signs that an email's sender is not legitimate — the deception at the heart of most phishing. Common anomalies: spoofed sender domains (claiming to be a trusted domain the message wasn't authorized to send from — exposed by header authentication), lookalike/typosquatting domains (visually similar to a real one, e.g. character substitutions or extra words), display-name spoofing (a friendly "From" name impersonating someone while the actual address is unrelated), unexpected senders (a message purporting to be internal or from a known contact but with anomalous origin), and mismatches between the display name, address, and reply-to. Recognizing sender anomalies — corroborated by header/authentication analysis — is central to identifying phishing, since impersonation is the attacker's core tactic.
How it works
The analyst scrutinizes the sender for anomalies: is the domain spoofed (authentication failures from headers show the message wasn't authorized for the claimed domain)? Is it a lookalike domain — subtly misspelled, using similar-looking characters, or with added words designed to pass a quick glance? Does the display name say one thing while the actual email address is unrelated (display-name spoofing, common on mobile where the address is hidden)? Is the reply-to different from the From (redirecting replies to the attacker)? Is the sender unexpected for the context (claiming to be a colleague/executive but from an external or odd source — as in business-email-compromise-style lures)? These anomalies are corroborated with header/authentication evidence (lesson 1). Because attackers rely on impersonation to gain trust, sender anomalies are among the most reliable phishing indicators — and user awareness of them (checking the actual address, not just the display name) is a key defense the SOC reinforces.
Practical example
Investigating a phishing report, the analyst examines the sender. The display name reads like a trusted internal executive, but the actual email address is an unrelated external address (display-name spoofing). The domain, on closer look, is a lookalike — a legitimate brand name with an extra word and a subtly different spelling. The reply-to points to yet another address. Combined with header authentication failures (from lesson 1), these sender anomalies clearly identify impersonation — a phishing attempt exploiting trust in a known name. The anomalies, corroborated by headers, made the deception evident.
Cybersecurity relevance
Sender anomalies are among the most reliable phishing indicators because impersonation is the attacker's core tactic: spoofed domains, lookalike/typosquatting domains, display-name spoofing, reply-to mismatches, and unexpected senders all signal a sender that isn't who it claims. Recognizing them — corroborated by header/authentication evidence (lesson 1) — is central to phishing detection and connects to the lookalike-domain concept from IOC analysis. User awareness of sender anomalies (verifying the actual address, not the display name) is a key human defense the SOC reinforces through awareness and reporting. Sender analysis, alongside headers, URLs, and attachments, is a pillar of the SOC's frequent phishing investigations.
Common mistakes
- Trusting the display name without checking the actual sender address.
- Missing subtle lookalike domains (character substitutions, extra words).
- Overlooking reply-to mismatches or the sender being contextually unexpected.
Key takeaways
- Sender anomalies signal an illegitimate sender — the deception at the heart of phishing: spoofed domains, lookalike/typosquatting, display-name spoofing, reply-to mismatches, unexpected senders.
- They're corroborated with header/authentication evidence; impersonation is the attacker's core tactic, making sender anomalies highly reliable phishing indicators.
- User awareness (verify the actual address, not the display name) is a key defense the SOC reinforces; sender analysis is a pillar of phishing investigation.
Check your understanding
- What are common sender anomalies in phishing, and how does display-name spoofing work?
- How do sender anomalies combine with header/authentication evidence to identify phishing?