If you are only looking at the email From: header value, that is trivial for a phisher to fake. You really need to read all of the Received: headers to see whe

If you are only looking at the email From: header value, that is trivial for a phisher to fake. You really need to read all of the Received: headers to see where the email transited (and, note, a phisher can insert fake Received: headers as well, so you have to be careful analyzing them to detect something amiss).