d1r7b46 things

Congrats to you at the Last! Task 1   Q: What is the email's timestamp? (answer format: dd/mm/yy hh:mm) A: 6/10/2020 05:58   Open this in a different way than you may first think.. I wonder what Thunderbird would make of this email?   MASSIVE TIP: At the time of this post, there is a glitch. It is not dd/mm/yy it is dd/mm/yyyy. You'll need the whole 2020 (what a year, amiright?)   Q: Who is the email from? A: Mr. James Jackson   Again check out the email when brought up in Thunderbird.   Q: What is his email address? A: info@mutawamarine.com   Q: What email address will receive a reply to this email?  A: info.mutawamarine@mail.com   Q: What is the Originating IP? A: 192.119.71.157   Q: Who is the owner of the Originating IP? (Do not include the "." in your answer.) A: Hostwinds LLC   Q: What is the SPF record for the Return-Path domain? A: v=spf1 include:spf.protection.outlook.com -all   I love MX ...

 Welcome again, we're getting close to finishing this one up!   

We Meet Again This module is all about getting into the actual phishing email header analysis. The biggest suggestion I have here is to get and stay curious about the oddities coming into your mailbox. Do header analysis on all those weird enhancement emails and pay close attention in the next upcoming module on how to handle potential malicious payloads so you learn the best way to open attachments and links.  But let's dig into this module first.

Kicking Off I was really excited to see this module come through on  TryHackMe  as my early work surrounded email security and I had to largely self teach. I am hoping that I can add in my thoughts from doing BEC  investigations over the past few years so that some more context is given to how much damage is done via email year over year.  As the first module notes, spam and phishing are common in the world of social engineering . Commonly, the threat actors that compromise email accounts are looking to divert funds in some way, utilizing further social engineering skills along with technical skills like spoofing to steal money.  If it isn't loss of funds, compromised accounts are commonly used to launch spam campaigns   (I love the link here from mail chimp because it tells us and threat actors how to bypass mail filters),  credential harvesting or Malspam,  so that the threat actor can pivot into another account. Often, we see these compro...