# Mail Forensics — Header Hunt (CTF challenge)

> A quarantined phishing email looks unremarkable — but one of its raw headers carries a hidden, encoded token. Download the .eml, read the headers, and decode the odd one out to get the flag.

Canonical: https://codelivly.com/ctf/challenges/forensics-email-headers

| | |
|---|---|
| Category | Forensics & OSINT |
| Difficulty | Easy |
| Points | 250 |
| Estimated time | 10 min |
| Type | Live instance |
| Solves | 87 |
| Author | Codelivly |

A quarantined phishing email looks unremarkable — but one of its raw headers carries a hidden, encoded token. Download the .eml, read the headers, and decode the odd one out to get the flag.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)