This is where I’ll write up interesting phishing emails I come across: the clever ones, the new tricks, and the occasional campaign that’s just bad enough to be funny.
What each write-up covers
Every analysis follows roughly the same structure, so they’re easy to compare and skim:
- Summary. What was impersonated and what the attacker wanted.
- The email. A redacted screenshot, the sender details and the lure.
- Header analysis. SPF, DKIM and DMARC results, and where the email really came from.
- Infrastructure. The links, redirects, domains and hosting behind it.
- Landing page or payload. What happens if someone clicks.
- TTPs. The techniques used, mapped to MITRE ATT&CK.
- Indicators of compromise. A table of defanged IOCs for defenders to hunt with.
- Takeaways. Detection ideas and lessons.
How indicators look here
All URLs, domains and IPs are defanged so they can’t be clicked by accident. The examples below use reserved documentation addresses, not real indicators:
| Type |
Indicator |
Notes |
| Domain |
example[.]com |
Landing page |
| URL |
hxxps://example[.]com/login |
Credential form |
| IP |
192.0.2[.]10 |
Hosting |
To use an indicator in your own tools, “refang” it by replacing hxxp with http and [.] with ..
More soon.
]]>