# Day 14: Phishing Email Investigation – “LIVELO Points Alert”

#### **Challenge Description:**

You received an email claiming to be from **BANCO DO BRADESCO LIVELO**, alerting you that your points are about to expire. The email contains detailed headers and a base64-encoded HTML body.

Your task is to **perform a forensic analysis** of the email to determine its legitimacy, trace its origin, analyze authentication mechanisms, and assess potential threats. This challenge simulates a real-world scenario where organizations must identify phishing emails targeting their users.

***

[**https://github.com/ngabalaax/30-day-soc**](https://github.com/ngabalaax/30-day-soc)&#x20;

#### **Challenge Objectives:**

1. **Trace the Email Path:**
   * Identify all email servers (hops) involved in relaying the email.
   * Determine the originating IP address and its geographical location.
2. **Authentication Analysis:**
   * Inspect SPF, DKIM, and DMARC headers.
   * Identify any authentication failures or errors.
   * Explain the meaning of `temperror`, `compauth=fail`, and other anomalies.
3. **Email Content Analysis:**
   * Decode the base64-encoded HTML body of the email.
   * Identify the main message and any hyperlinks or attachments.
   * Highlight suspicious elements such as fake domains, misleading links, or social engineering tactics.
4. **Threat Assessment & Mitigation:**
   * Determine if the email is likely a phishing attempt.
   * Suggest immediate actions to mitigate risk (e.g., report, quarantine).
   * Explain why users should be cautious with similar emails.
5. **Optional Bonus Objective:**
   * Identify any potential indicators of compromise (IOCs) that could be used for threat intelligence (e.g., sender IP, domains, URLs).

***

#### **Hints for Participants:**

* Use **online tools or local scripts** to trace the IP addresses in the `Received` headers.
* Pay attention to **SPF, DKIM, and DMARC results** – even minor errors can indicate spoofing.
* To decode the base64 email body, you can use tools like:
  * `base64 --decode` (Linux)
  * Python: `import base64; print(base64.b64decode(encoded_body).decode())`
* Inspect the HTML carefully; phishing emails often use **legitimate-looking logos or brand names** but include **fake links**.
* Look at the `Return-Path`, `X-Sender-IP`, and `X-SID-PRA` headers for additional clues.

### **Step-by-Step Walkthrough – Phishing Email Investigation**

#### **Step 1: Review the Email Headers**

1. Open the email in a client that allows you to view **full headers**.
2. Look for the `Received` headers to trace the email’s route.
3. Identify the **originating IP address** (usually in the bottom-most `Received` header).
4. Optional: Use an **IP geolocation tool** to determine the sender’s location.

**Tips:**

* Check for multiple `Received` headers; the order is **bottom to top**.
* Note any anomalies like `localhost` or unusual IP addresses.

***

#### **Step 2: Analyze Email Authentication**

1. Locate the **SPF, DKIM, and DMARC results** in the headers.
   * SPF: `pass` / `fail` / `temperror`
   * DKIM: `pass` / `fail`
   * DMARC: `pass` / `fail`
2. Investigate any **failures or errors** and what they indicate.
3. Confirm whether the email was likely sent from a legitimate server.

**Example Hints:**

* `compauth=fail` → Composite authentication failed, likely spoofed.
* `temperror` → Temporary issue verifying SPF; might indicate misconfigured domain.

***

#### **Step 3: Decode the Email Body**

1. Locate the **base64-encoded part** in the email body (`Content-Transfer-Encoding: base64`).
2. Decode the base64 content:
   * Linux: `base64 --decode encoded_file > decoded.html`

***

#### **Step 4: Analyze the Email Content**

1. Look for **branding and logos**; check if they match official sources.
2. Inspect **links** carefully:
   * Hover over them to see the real URL.
   * Check for typos, extra characters, or unrelated domains.
3. Identify any **calls to action** such as “Click to redeem points” or “Update your account.”
4. Note suspicious **attachments** or scripts embedded in the HTML.

***

#### **Step 5: Assess Phishing Risk**

1. Based on headers and content, determine:
   * Is this a **legitimate email** or a **phishing attempt**?
   * Which elements make it suspicious?
2. Decide appropriate **mitigation steps**:
   * Report to IT/security team.
   * Quarantine email.
   * Avoid clicking links or downloading attachments.

***

#### **Step 6: Optional – Extract IOCs (Indicators of Compromise)**

1. Collect:
   * Sender IPs
   * Sender domain and reply-to address
   * URLs in email body
   * Hashes of attachments (if any)
2. Add these to your **threat intelligence database** for future reference.

***

#### **Step 7: Document Your Findings**

1. Create a **summary report** including:
   * Email origin and path
   * Authentication results
   * Suspicious content analysis
   * Phishing likelihood and mitigation steps
   * Optional: IOCs

**Tip:** Clear, organized reporting is critical in real-world investigations.
