all investigations
Threat Inteleasy
The Lure
A user reported a suspicious invoice email. Analyze the raw email headers to assess whether it was spoofed and where it really came from.
// evidence
Raw email headers— Headers as received by our mail gateway
Return-Path: <billing@acmе-payments.com> Received: from mail.hostinger-vps.io (193.201.9.44) by mx.corp.local Authentication-Results: mx.corp.local; spf=fail (sender IP is 193.201.9.44) smtp.mailfrom=acme-payments.com; dkim=none; dmarc=fail action=quarantine From: "Acme Billing" <billing@acme-payments.com> Reply-To: recover-funds@proton.me Subject: Overdue Invoice #INV-88213 - Immediate Action Required X-Mailer: PHPMailer 6.1
// tasks (0/4)
1
Did SPF pass or fail for this message? · 15 pts
// graded hints — spend XP to unstick
2
What is the sending server's IP address? · 20 pts
// graded hints — spend XP to unstick
3
Which Reply-To address should the analyst flag as the attacker's collection inbox? · 20 pts
// graded hints — spend XP to unstick
4
What DMARC action did the gateway apply? · 15 pts
// graded hints — spend XP to unstick