Back to case studies
Intermediate1 h - 1 h 30
Investigating a phishing email
A “payslip” email was reported by several employees. Analyze the headers, the link and the infrastructure to trace it back to the attacker.
Briefing
Monday 9:12 am, the Mireval Insurance SOC receives 14 reports about the same email: “Your October payslip is available”. Two people clicked the link, one entered their password. You have the raw email (.eml) and the results of a few passive lookups. Goal: establish the facts, extract the indicators and recommend actions.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Read the authentication headers (SPF, DKIM, DMARC)
- Identify the real originating IP
- Deobfuscate the link and find the real domain
- Pivot on the infrastructure
- Prioritize the incident response
Tools used in real investigations
MXToolbox Header Analyzerurlscan.ioWHOIS / RDAPVirusTotalAbuseIPDBMicrosoft 365 Defender
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.