search

Phishing Analysis 2

What is the sending email address?

# open .eml in thunderbird
amazon@zyevantoby.cn

What is the recipient email address?

# open .eml in thunderbird
saintington73@outlook.com

What is the subject line of the email?

# open .eml in thunderbird
Your Account has been locked

What company is the attacker trying to imitate?

# open .eml in thunderbird
amazon

What is the date and time the email was sent? (As copied from a text editor)

From: Amazn <amazon@zyevantoby.cn>
To: saintington73 <saintington73@outlook.com>
Subject: Your Account has been locked
Date: Wed, 14 Jul 2021 01:40:32 +0900

Wed, 14 Jul 2021 01:40:32 +0900

What is the URL of the main call-to-action button?

Look at the URL using URL2PNG. What is the first sentence (heading) displayed on this site? (regardless of whether you think the site is malicious or not)

When looking at the main body content in a text editor, what encoding scheme is being used?

What is the URL used to retrieve the company's logo in the email?

For some unknown reason one of the URLs contains a Facebook profile URL. What is the name of this user when viewing their profile?

PreviousPowerShell Analysis - KeyloggerNextILOVEYOU

Last updated