Trace a Phishing Email and Draft the Takedown Report

A phishing email that copies your bank is not just junk for your spam folder. The fake site behind it harvests passwords from everyone who clicks. A muse can trace where the message and the site came from and draft the abuse report that asks the host to take it down.

What it does

Every email carries a hidden travel record in its headers: the servers it passed through and the real source it started from. The link in the message also points somewhere, usually to a look-alike domain hosted by a company that has an abuse desk. Reading that record by hand is slow and tedious. A muse can open the headers of a message you hand it safely, work out the sending source and the site host, and check the details that give a fake away, such as a domain registered days ago that copies a real brand. It then drafts the takedown report in the shape abuse desks want: the fake address, the brand it copies, the evidence, and the time you received it. You read the report, and it goes out only when you say so.

How to use it

1. Do not click anything in the email. Forward it to the muse as an attachment, or paste the full headers from the message details view. Never open the fake link yourself.
2. Ask the muse to trace it: "Show me where this came from, where the link really points, and who hosts that site."
3. Read the trace with a plain eye. The muse should show its evidence, not just a verdict.
4. Review the draft report, correct any mistakes, and approve the send, or send it yourself.
5. Report the message inside your mail app as phishing too. The takedown handles the site; the report helps filter the next copy.

What you need

• The suspicious email, kept unclicked
• The full headers, through your mail app's message details or show original view
• A muse account

What to watch for

• A takedown is a request, not a switch. Hosts act at different speeds, and fake sites move fast. The report still matters: it helps the next copy get caught sooner.
• Never hand the muse your mailbox password. Bring the message to the muse with a forward or a file.
• Tracing shows where a message passed through, not who sent it. Keep the report factual and skip guesses about identity.
• If you already clicked and entered a password, the order flips: change that password from the real site first, then trace.