What indicators help identify phishing and spear-phishing in email logs?

• A. Suspicious sender and domain anomalies.
• B. Suspicious sender, domain anomalies, malicious attachments, and suspicious links.
• C. Only the subject line matters.
• D. Attachment size alone determines phishing.

Answer: (B)

Phishing and spear-phishing show up in logs through a combination of red flags that point to someone pretending to be legitimate, using dubious domains, and delivering harmful content. A suspicious sender is often the first clue—the From address or display name may be spoofed or belong to a known but compromised account. Domain anomalies compound this, such as look-alike or typosquatted domains, mismatches between the sending domain and the claimed organization, or failures in authentication checks like SPF, DKIM, or DMARC. These domain signals help distinguish attempts to imitate trusted sources from ordinary mail.

Malicious attachments are another critical indicator. Email logs can reveal attachments that are executable, macros-enabled documents, or file types commonly used to deliver malware. The presence of such attachments, especially in combination with other red flags, raises the likelihood of a phishing attempt. Suspicious links complete the set of telltales: URLs that redirect to unfamiliar or misnamed domains, shortened links, or links whose hostnames don’t match the purported brand or purpose, even if the message looks otherwise legitimate.

Together, these indicators—suspicious sending, domain irregularities, dangerous attachments, and dubious links—provide a comprehensive signal in email logs that phishing and spear-phishing are underway. Relying on any single factor, like the subject line or attachment size alone, can miss many phishing attempts, while the combination of these signals gives you a much stronger basis for identification.