We're going to be going over a email investigation.
And for this we're taking a look at a real spam email or actually a scam email.
So let's take a look.
So this is a pretty common one I've been getting lately.
Supposedly it's from Costco.
It says Reclaim your gift card.
So the attack vector of this is, well, greed.
So supposedly I have a gift card waiting for me from Costco.
I click on it, I get my savings, I get my gift card that I never signed up for.
And actually, I never gave Costco my my email for this.
So that's kind of interesting.
I got that.
But anyways.
The idea is the scammers are sending these out.
I click on it and it could do a number of things.
It could install a virus on my computer.
It could steal my my user account information.
It could do a remote Trojan on my computer.
It could simply send me to a website where since I go to it, they they get the click count for it and
potentially make money off it.
But that way there's a number of attack vectors for this.
So let's break this down in terms of investigating this.
So again, I, I know this is a scam email for a couple of reasons right off the bat.
One, again, I do have a Costco membership.
However, they do not have my email address.
So getting the email from them is highly suspect.
And of course, if we're taking a look at whether it is a legitimate email or not, if we're not sure,
we take a look at well, we take a look at who sent it.
We also want to check who the link is and we can do that with a link cover we take take our mouse.
If we're on a computer, we hover over the link and it'll give us a URL.
So this is supposedly going to Costco.
However, the actual email or actual URL rather is going this holla myex.com blah blah blah.
So not Costco.com.
So that's a big red flag right there.
Matter of fact, if it actually takes you to multiple places.
So on my phone, if you I have an iPhone, if you kind of hold down on the link and kind of push down,
you have to be real careful about this.
You could do a preview link.
And on that preview link, I saw it.
Want to take me to good news now for you.
So a Russian site again, not Costco.
So other things we could do is we could take a look at the email header and that's if you're investigating
it, that's one of the first things you want to do.
Take a look at the sender, hover over the link and do show original email.
And let's take a look at the actual full email header in here.
We could potentially find some interesting information.
Again, we can find who actually sent the email.
We might potentially be able to go back and find.
Trace back where this email is going coming from ET.
Not very likely.
If they're using things like, say, Gmail, Yahoo!
Outlook, etcetera, because those free email servers generally do a pretty good job of user privacy,
which is of course great for user privacy.
However bad for if we're actually doing osint or tracking down where the original email came from.
So another thing we're going to take a look at again, We take a look at who sent this Is it from Costco.com?
Well, in this case, no.
We see from down here it looks like it came from Costco.com.
We have to send field here.
However, the real mail link is right here.
This 4577355 support at Significo za Now za is South Africa.
Nigeria.
ET cetera.
Around that area.
So again, obviously not Costco.
It's a spoofed email address.
So taking that email address, we can put it into our data breach sites, things like have I been pwned?
If we have our own personal data breach site like, say, the com data breach combination of many breaches
or we could put in things like hash or any number of other data breaches and see if that came up.
Now, chances are, with a lot of these scams, you're not going to see any leak credentials from those
because they're going to be pretty one off systems.
They're going to run this thing for a day, maybe a couple of days, and then kill it.
They're not going to use it again.
So there's generally not a lot of chance that you're going to see a data breach of this.
But you might get lucky.
Maybe someone's got sloppy and start reusing the email over and over and they use it for other stuff
other than trying to scam people.
We could also take that email and we can put in something like Maltego.
So we put we put in Maltego, we pull up the email address, put it in there, and then we run a scan.
So from here with the particular plugins I have for Maltego, it does have have I been phone search?
We can, we can see it's the signify code.
ZA It kind of splinters off.
We can see the servers and potentially be able to track down the source from there.
Now taking the links that that we found on that particular email, we could do domain registry lookups.
Things like domain tools, who is records and whatnot.
Put it in there and we can start taking a look at information of, well, it wants me to go to these
websites.
What are these websites?
Well, putting this particular one in this good news.
Now, what are you doing?
A reverse search.
We could see various information.
We could see when it was created in March 25th, 2021.
It expires in a year.
So we see that it was only registered for a year.
So they weren't planning on using this for very long.
They probably picked a domain pretty cheap registered for for a year because that's the minimum you
could do anyways and try to start scamming people that way.
We can see the IP address.
We could see the IP location.
We could see the name servers, we could see it's going through Cloudflare.
So they are spending some money here and we may potentially be able to find things like phone numbers
and names and addresses and etcetera.
Doing a domain search.
And if we do, who is search?
We could actually find the abuse phone number in here and we can find the email contact in here, which
probably is not going to work.
But we did find a phone number in here.
Now, with that phone number, we could do a reverse phone number, search things like spy dialer,
whitepages, etcetera.
There's a lot of different phone number reverse searches we could do.
Now putting the phone number in my identified as a landline.
Now, what can we do with that?
Well, we can do a name lookup.
We could do with Spy dollar.
We could hear the voice mail, we could use a burner phone number, we could use a voice over IP phone
number and call that number, see if it is a landline.
If anyone picks up, who do they identify as?
As ET cetera.
Is it a cell phone?
Most likely it's going to be a voice over IP number that's going to be highly disposable.
But again, we might get lucky.
We might be able to get more information from it that way.
We can also do, of course, our Google searches, DuckDuckGo searches, whatever.
Your search engine of choice is.
Now taking some of the other sites that were popping up on here.
We could see various information here.
And on the Russian side that came up, we could do a Russian business search.
And I also found it down in here when I went on to Alienvault while doing a Google search.
And we could see things like group known as VIP one delivers a link through phishing emails.
Links lead to a series of redirects, works best with opera, different ad fraud campaigns running through
this, and again, we can find more information about it.
So now we know.
Hey, this is from a group known as VIP one and this is what they do.
And this was identified on this date.
And again, we can get more information from that.
So wrapping up these email addresses and URLs typically don't last very long.
They might last for a couple of days at best.
Typically, if I get one of these and I decide to start doing investigation the next day, those links
are dead.
Emails tend to change very quickly.
Again, these are designed to be highly disposable and cheap.
A lot of times people will use either free services or they'll again get a domain for a year, probably
pick it up real cheap and start generating a bunch of emails and start doing these attacks.
That particular email address that I showed you, I got three more of those emails, exact same type
of emails.
However, the address changed slightly, even though the domain was still the same.
So that shows me that, okay, they're generating a lot of different emails from that same domain,
probably trying to get the most out of their money.
Now the domain registration, if any, are likely to be purchased cheaply and disposable again, it
can make it a little bit harder to track because of this.
So if we want to keep going after these people and trying to find more about them, we could try things
like social engineering, maybe drop a canary token, send an email to them and go, Oh, well, you
know, I had problems with the link.
ET cetera.
And try to draw them out.
Or even if you find the phone number attached on the domain, you might get lucky again.
Get a hold of a live person, use some social engineering techniques to to draw out more information
about them.
So this was about email investigations and identifying phishing emails and doing investigations on them.
Thank you for watching.
I'll see you next video.