Open Reported Emails In A Sandbox – Knowledge Base

You can safely open and interact with reported emails using the sandbox environment. This feature is designed to help administrators make informed judgments about reported emails. By safely interacting with messages, links, and attachments in an isolated environment, admins can better assess intent and correctly attribute emails as spam, phishing, or legitimate.

To open an email in a sandbox, it needs to be reported, and it cannot be a simulated phishing email. To get started with email reporting, head to our Phish Triage Launch Pad.

Every sandbox session is recorded and produces a session report that you can review, export and share for 30 days.

How to access the sandbox

Go to Phish Triage.
Click the email you want to review in the REPORTED BY column.
Open the Sandbox tab.
Click Open email in sandbox environment.

The sandbox takes around 5 to 10 seconds to start.

Sessions are recorded

Hover over Open email in sandbox environment to read the disclosure before you start:

Recording: This session is recorded for a session report: the sandbox screen, the processes, files and network activity inside the sandbox, and when you click or type. Anything shown on screen, including text typed into fields, is captured. Reports are kept for 30 days and can be opened by other sandbox users in your account.

The note under the button repeats the most important rule:

Never enter real usernames, passwords or one-time codes in the sandbox. Sessions are recorded.

What happens in the sandbox

Once the sandbox loads, the email opens inside Mozilla Thunderbird running in an isolated Ubuntu Desktop Virtual Machine. You can essentially interact with the message as if it were on a real device.

From here, you can safely:

Open and read the email
Click and load embedded links to see where they lead
Open attachments

All activity stays contained within the sandbox, so your own endpoint remains protected.

The Network & Processes panel shows activity live, in six tabs: Processes, Network, HTTP, DNS, Files and Timeline. On the HTTP tab: "Only apps that use the sandbox proxy (Firefox, Thunderbird, most command-line tools) appear here. Every connection is listed under Network." Processes that were running when you connected, such as Thunderbird, are marked already running.

Session limits

Each sandbox session lasts 15 minutes. After this time, the environment is automatically destroyed.

When the session ends, for example when you click Disconnect or the time runs out, the Sandbox tab shows Building the session report…: "The sandbox has closed. The report appears in Session reports below once it is ready, usually within a minute."

Session reports

Every recorded session is listed under Session reports on the reported email's Sandbox tab, newest first. Each row shows when the session started, how long it ran, who initiated it, a summary of its activity and its status. Click Open report to open the report in a new tab. Reports are kept for 30 days.

The DNS log is added a few minutes after the rest of the report: "The DNS log is still being fetched and will be added in a few minutes."

Status	Meaning
Recording	The session is still open, or its recording is still being saved.
Processing	The report is still being finished, for example the DNS log lookup that runs a few minutes after the session ends.
Complete	Everything was captured.
Partial	Usable, but something was missing or cut short. The report lists what.
No activity	The session was recorded but nothing happened in it.
No recording	The session was started but nothing was recorded for it.
Incomplete	The session never finished recording.
Failed	The recording failed; only the session details were saved.

What's in a session report

Every report opens with this warning: "Everything below was captured inside the sandbox and may be hostile. Links and addresses are shown defanged and are never clickable."

Tab	What it shows
Overview	Activity counts, behavior observed (mapped to MITRE ATT&CK), content you opened, warnings and session details. Registry and Mutexes show N/A (Linux sandbox).
Timeline	Every event in order, filtered by type. Activity that followed a click or typing is marked, for example after click at 01:23. Click the mark to jump to that moment in the replay.
Processes	The process tree with command lines. Processes that were running when you connected are marked already running.
Network	HTTP requests, DNS lookups, connections, form posts, certificates and blocked requests.
Files & downloads	Files created, changed, moved or deleted, plus the hashes and file types of downloads. The files themselves never leave the sandbox.
Clipboard	Text that applications placed on the sandbox clipboard. For text you pasted in, only the length is recorded, never the text.
IOCs	The indicators from this session, with Export CSV and Export JSON. See IOCs and MITRE ATT&CK below.
Replay	The screen recording, with Play, Speed (1×, 2× or 4×), a position slider with your clicks marked, and Save frame, which saves the frame shown as a PNG image.
Downloads	The HTTP archive (HAR) and the raw telemetry. The HAR holds request and response metadata without bodies; cookie, authorization and token values are redacted. Download links are valid for 5 minutes once clicked.

IOCs and MITRE ATT&CK

Indicators of compromise (IOCs) are listed in two places:

Session report > IOCs: the indicators from one sandbox session. Click Export CSV or Export JSON, or tick Show excluded indicators to see what was left out.
Analysis tab > IOCs: the reported email's Indicators of compromise, from the email, its links and attachments, the URL sandbox and every interactive sandbox session. Click Copy to copy the defanged indicators, or CSV or JSON to export them. The CSV and JSON buttons are shown to users who can use the sandbox.

"Indicators are defanged on screen ([.] and hxxp) so they cannot be opened by accident; exports contain the original values. Our own infrastructure, private addresses and the sandbox's own traffic are left out of the CSV and listed in the JSON export with the reason." On the Analysis tab, tick Show excluded to see them with that reason: Our platform, Our storage, Our CDN, Browser background traffic, Private or local address, Sandbox injection or Sandbox infrastructure.

Findings are mapped to MITRE ATT&CK techniques where a technique genuinely fits, and shown as chips such as T1204.002. Hover over a chip to see the technique's name and tactic, or click it to open the technique on attack.mitre.org.

On the Analysis tab, chips appear next to the findings under What the sandbox found and next to attachment findings.
In a session report, the Overview's Behavior observed list carries them. As the report says: "Nothing here is a verdict, and collection is best effort, so an empty list does not prove nothing happened."

You can share a session report through a link that works without signing in.

Open the session report and click Share. The button is available once the report is ready.
Choose how long the link works: 1 day, 7 days or 30 days.
Click Create link, then Copy.

The Share dialog explains what the link gives access to:

Anyone with the link can view this session report without signing in: the timeline, processes, network activity, files, IOCs and the screen recording, with the reported email's subject, sender and date. A link works for the time you choose, and never after the session's data is deleted 30 days after the session.

Copy the link now: it is not shown again. If the time you chose runs past that deletion, the dialog says the link is available until that date, "when this session's data is deleted."

The shared page is headed "Shared link, available until" with the expiry date, and shows the reported email's Subject, From and Date. Recipients can open every report tab, including the replay, download the HAR and export the IOCs as CSV or JSON.

In the Share dialog, under Active links, click Stop sharing next to the link and confirm: "Stop sharing with this link? It stops working immediately."

When a report can't be shared

The Share dialog refuses a new link with one of these messages:

"Reports of phishing simulations cannot be shared."
"The reported email for this session could not be loaded, so the report cannot be shared. Please try again."
"This report already has 20 active links. Stop sharing one first."
"This session's data is about to be deleted, so it can no longer be shared."

When a link stops working

A link stops working when it expires, when sharing is stopped, or when the session's data is deleted 30 days after the session. Anyone who opens it then sees "This link is not available": "The shared sandbox report has expired, sharing was stopped, or the link is incomplete. Ask the person who shared it for a new link." If the report is busy, they see "This report can't be shown right now" and "Please try again in a few minutes."

Abuse Monitoring

Please note that CanIPhish logs and monitors high-level network activity (i.e., IP addresses contacted and DNS queries made) to ensure the sandbox is used for strictly legal and non-malicious purposes.