参考资料库
取证分诊速查表
浏览器本地 IOC、hash、邮件头、defang、Safe Links 和日志时间线提醒。
Defanged URL
参考： Safer sharing shape for suspicious URLs.
hxxps://example[.]com/pathIPv4 IOC
参考： Documentation-range IP example for IOC extraction.
203.0.113.10MD5 length
参考： Common hash identifier hint.
32 hex charactersReceived header
参考： Email path header shape.
Received: from host by mx;