Lire en françaisع
Menu

Back to the Academy

CLR-2 · Hands-on lab · Easy ·about 25 min

Phishing: what the headers say

A colleague reported a "parcel on hold" email. Read its raw headers in the terminal, check SPF and DMARC, trace where it came from and decode the real link without clicking it.

Briefing

You work in the SOC of NovaRetail. Salma, from accounting, forwarded an email she found strange: a parcel company asks her to pay 14.90 MAD of customs fees, but she did not order anything.

Your job is to confirm, with evidence, whether it is phishing. The raw email is waiting in reported/, with a genuine internal email next to it for comparison.

What to look for:

  1. Who really sent it: the visible From: can say anything. The envelope sender and the authentication results tell the truth.
  2. Where it came from: the Received: headers are a trail of servers, written from the bottom up.
  3. Where the link leads: never click. Decode it.

Start with cat reported/TICKET-5107.txt, then head -n 25 reported/parcel-on-hold.eml. Everything here is simulated: the domains end in .example or .test, which do not exist on the internet.

Terminal

Type help to list the commands. Tab completes, ↑ ↓ browse the history.

Questions

  1. The email claims to come from atlas-express.example. Which domain does the Return-Path (the envelope sender, where bounces go) actually use?25 XP

    1. Our mail server recorded its checks in Authentication-Results. What was the DMARC result? One word.25 XP

      1. Which IP address handed this email to our server mx.novaretail.example?25 XP

        1. The "Pay now" link goes through a tracking redirect. Decode where it really leads. What is the registered domain of the destination (the last two labels, like example.com)?25 XP