Phishing Investigations

My current process is to open the phishing link in a protected VM that’s snapshotted, then rolled back later and VPNed to the Internet via a cloud VPS/Wireguard. Then I can deconstruct documents and grab executable samples. I’m strongly tempted to move to a Qubes-based analysis platform though. Before I do, I was wondering if anyone had gone that route, and if they’d faced any issues?

cybersecurity investigations phishing