Multi-Source Phishing Email Analysis
Analyze phishing emails with EmailRep, URLScan, and VirusTotal to produce a comprehensive threat report.
Overview
A comprehensive phishing triage playbook that runs suspicious emails through three threat intelligence sources in parallel: EmailRep for sender reputation, URLScan.io for URL analysis, and VirusTotal for attachment hashing and URL scanning. Aggregates the findings into a single security report.
Who this is for: Tier-2 SOC analysts doing deeper phishing triage than VirusTotal alone provides
Why automate this
Single-source phishing triage misses indicators that another tool would catch. Running EmailRep, URLScan, and VirusTotal in parallel gives you defense-in-depth at the analysis stage. Each tool contributes a different lens, and the aggregated verdict is far more reliable than any single source.
How it works
- 01
Retrieve the suspicious email from the inbox
- 02
Extract sender email, URLs, and attachments
- 03
Submit the sender to EmailRep for reputation scoring
- 04
Submit each URL to URLScan.io for deep analysis
- 05
Submit URL reputations to VirusTotal in parallel
- 06
Hash each attachment and look up in VirusTotal
- 07
Aggregate all three verdicts into a unified threat score
- 08
Generate a structured report for the analyst
Impact
Three-source verdict reduces false negatives significantly
Parallel execution keeps total runtime under 30 seconds
Structured report means consistent analyst handoff
Each verdict is logged for trend analysis and tuning
Related playbooks
Keep automating
Suspicious Email Triage with EDR Correlation
Multi-tool email triage that cross-references threat intel with CrowdStrike endpoint detections.
Outlook Phishing Detection with VirusTotal
Scan every inbound Outlook email for malicious URLs and attachments, delete threats, and notify Slack.
Gmail Phishing Detection with VirusTotal
Scan incoming Gmail messages for malicious links and attachments, delete threats, and alert security.
Bring this playbook into your SOC
See Deployer Workflows in action with a live walkthrough of this playbook. We'll show you how to connect your SIEM, EDR, and ticketing tools in under 15 minutes.