</span><span class="hidden transition group-open:block"><svg width="25" height="25" viewBox="0 0 25 25" fill="none"><path d="M8.5 12.3105h8m6 0c0 5.5229-4.4772 10-10 10-5.52285.0-10-4.4771-10-10 0-5.5228 4.47715-9.99995 10-9.99995 5.5228.0 10 4.47715 10 9.99995z" stroke="#98a2b3" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></summary><div class="pe-6 pt-4">Th1s_1s_pH1sh1ng_Em3il</div></details><h2 id=other-resources-and-links>Other resources and links <a aria-label=#other-resources-and-links href=#other-resources-and-links class="anchor-link no-underline"><svg aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentcolor" class="h-6"><path stroke-linecap="round" stroke-linejoin="round" d="M13.19 8.688a4.5 4.5.0 011.242 7.244l-4.5 4.5a4.5 4.5.0 01-6.364-6.364l1.757-1.757m13.35-.622 1.757-1.757a4.5 4.5.0 00-6.364-6.364l-4.5 4.5a4.5 4.5.0 001.242 7.244"/></svg></a></h2><div class="transition-200 relative mb-6 flex w-full items-center space-x-3 rounded-3xl border-2 border-gray-300 bg-white p-4 shadow-3xl transition-shadow focus-within:shadow-none focus-within:ring-2 focus-within:ring-green-500 focus-within:ring-offset-2 hover:border-gray-400 hover:shadow-none"><div class=p-6><p class="mb-2 mt-0 text-2xl font-bold">Access Now helpline community documentation for responding to suspicious/phishing emails</p><span class="mb-2 me-2 inline-block rounded-full border-2 border-indigo-300 bg-indigo-50 px-2 py-0 text-sm font-semibold text-indigo-700">Free</span><p class="mb-3 mt-0">Client Receives a Suspicious/Phishing Email</p><div class=mb-2><span class="text-sm font-semibold">اللغة</span>: <span class="mb-0 inline-block text-sm">English</span></div><a href=https://accessnowhelpline.gitlab.io/community-documentation/58-Suspicious_Phishing_Email.html# target=_blank rel="noopener noreferrer" class="mt-2 inline-block rounded-lg bg-green-700 px-4 py-2 font-bold text-white visited:!text-white no-underline hover:bg-green-800">زيارة الموقع</a></div></div><div class="transition-200 relative mb-6 flex w-full items-center space-x-3 rounded-3xl border-2 border-gray-300 bg-white p-4 shadow-3xl transition-shadow focus-within:shadow-none focus-within:ring-2 focus-within:ring-green-500 focus-within:ring-offset-2 hover:border-gray-400 hover:shadow-none"><div class=p-6><p class="mb-2 mt-0 text-2xl font-bold">List of all DNS record types</p><span class="mb-2 me-2 inline-block rounded-full border-2 border-indigo-300 bg-indigo-50 px-2 py-0 text-sm font-semibold text-indigo-700">Free</span><p class="mb-3 mt-0">Includes (almost?) all DNS record types.</p><div class=mb-2><span class="text-sm font-semibold">اللغة</span>: <span class="mb-0 inline-block text-sm">English</span>, <span class="mb-0 inline-block text-sm">Chinese</span>, <span class="mb-0 inline-block text-sm">Japanese</span>, <span class="mb-0 inline-block text-sm">Korean</span>, <span class="mb-0 inline-block text-sm">Russian</span>, <span class="mb-0 inline-block text-sm">Serbian</span>, <span class="mb-0 inline-block text-sm">Ukrainian</span>, <span class="mb-0 inline-block text-sm">Esperanto</span>, <span class="mb-0 inline-block text-sm">Hungarian</span>, <span class="mb-0 inline-block text-sm">Vietnamese</span>, <span class="mb-0 inline-block text-sm">Italian</span>, <span class="mb-0 inline-block text-sm">Spanish</span>, <span class="mb-0 inline-block text-sm">French</span></div><a href=https://en.wikipedia.org/wiki/List_of_DNS_record_types target=_blank rel="noopener noreferrer" class="mt-2 inline-block rounded-lg bg-green-700 px-4 py-2 font-bold text-white visited:!text-white no-underline hover:bg-green-800">زيارة الموقع</a></div></div><div class="transition-200 relative mb-6 flex w-full items-center space-x-3 rounded-3xl border-2 border-gray-300 bg-white p-4 shadow-3xl transition-shadow focus-within:shadow-none focus-within:ring-2 focus-within:ring-green-500 focus-within:ring-offset-2 hover:border-gray-400 hover:shadow-none"><div class=p-6><p class="mb-2 mt-0 text-2xl font-bold">Amnesty reports on phishing campaigns</p><span class="mb-2 me-2 inline-block rounded-full border-2 border-indigo-300 bg-indigo-50 px-2 py-0 text-sm font-semibold text-indigo-700">Free</span><p class="mb-3 mt-0">A list of examples of how a targeted phishing campaign against human right defenders, activists and journalists looks</p><div class=mb-2><span class="text-sm font-semibold">اللغة</span>: <span class="mb-0 inline-block text-sm">Multiple</span>, <span class="mb-0 inline-block text-sm">depending on the report</span></div><a href=https://www.amnesty.org/en/search/phishing/ target=_blank rel="noopener noreferrer" class="mt-2 inline-block rounded-lg bg-green-700 px-4 py-2 font-bold text-white visited:!text-white no-underline hover:bg-green-800">زيارة الموقع</a></div></div></div><div class="absolute mt-8 hidden h-full -left-64 2xl:max-w-full xl:max-w-64 2xl:-left-96 xl:block"><div class=h-full><div class="sticky top-0 px-4 py-2"><h2 class="mb-4 mt-3 text-xl font-bold">جدول المحتويات</h2><div class="max-w-72 space-y-2 h-svh overflow-y-auto toc-container toc-scrollbar"><nav id=TableOfContents><ul><li><ul><li><a href=#question-1-what-is-the-sender-address-of-the-email>Question 1: What is the sender address of the email?</a></li><li><a href=#question-2-what-is-the-subject-of-this-email>Question 2: What is the subject of this email?</a></li><li><a href=#question-3-what-is-the-action-requested>Question 3: What is the action requested?</a></li></ul></li><li><a href=#recognizing-the-threat>Recognizing the Threat</a><ul><li><a href=#question-4-defang-the-confirm-link>Question 4: Defang the “Confirm” Link</a></li><li><a href=#question-5-use-cyberchef-to-extract-and-defang-all-the-links-in-the-email>Question 5: Use CyberChef to extract and defang all the links in the email</a></li></ul></li><li><a href=#passive-investigation-of-urls-hostnames-and-ip-addresses>Passive Investigation of URLs, Hostnames, and IP Addresses</a><ul><li><a href=#question-6-when-was-the-url-defanged-in-question-4-submitted-to-virustotal>Question 6: When was the URL defanged in question 4 submitted to VirusTotal?</a></li><li><a href=#question-7-what-does-virustotal-give-as-the-serving-ip-address-for-the-url-defanged-in-question-4>Question 7: What does VirusTotal give as the serving IP address for the URL defanged in question 4?</a></li><li><a href=#question-8-how-many-vendors-on-virustotal-detect-this-url-as-malicious>Question 8: how many vendors on VirusTotal detect this URL as malicious?</a></li><li><a href=#question-9-in-which-registrar-was-the-domain-defanged-in-question-4-registered>Question 9: In which registrar was the domain defanged in question 4 registered?</a></li><li><a href=#question-10-where-is-the-serving-ip-that-you-identified-through-virustotal-geographically-located>Question 10: Where is the serving IP that you identified through VirusTotal geographically located?</a></li></ul></li><li><a href=#passive-investigation-of-email-headers>Passive Investigation of Email Headers</a><ul><li><a href=#question-11-what-is-the-return-path-of-the-initial-email-you-looked-up>Question 11: what is the return path of the initial email you looked up?</a></li><li><a href=#question-12-what-are-the-first-hop-and-smtp-server-address-of-that-email>Question 12: What are the first hop and SMTP server address of that email?</a></li></ul></li><li><a href=#active-investigation-of-malicious-web-pages>Active Investigation of Malicious Web Pages</a><ul><li><a href=#question-13-what-is-the-victim-id-present-in-the-code-of-the-website>Question 13: What is the victim Id present in the code of the website?</a></li></ul></li><li><a href=#other-resources-and-links>Other resources and links</a></li></ul></nav></div></div></div></div></article><script>document.addEventListener("DOMContentLoaded",function(){const o=document.querySelectorAll("#TableOfContents a"),e=Array.from(o),n=e.map(e=>{const t=e.getAttribute("href").slice(1);return document.getElementById(t)});let t=!1;function s(){if(t)return;const o=window.scrollY+window.innerHeight/2;let s=-1;for(let e=0;e<n.length;e++){const t=n[e];if(t&&t.getBoundingClientRect().top+window.scrollY<=o)s=e;else break}if(e.forEach(e=>e.classList.remove("active-element")),s!==-1){e[s].classList.add("active-element");const t=document.querySelector(".toc-container");if(t){const n=e[s],o=n.getBoundingClientRect(),i=t.getBoundingClientRect(),a=o.top-i.top-t.clientHeight/2+n.clientHeight/2;t.scrollTop=a}}}e.forEach(n=>{n.addEventListener("click",function(s){const i=n.getAttribute("href").slice(1),o=document.getElementById(i);o&&(s.preventDefault(),t=!0,o.scrollIntoView({behavior:"auto",block:"start"}),e.forEach(e=>e.classList.remove("active-element")),n.classList.add("active-element"),setTimeout(()=>t=!1,100))})}),window.addEventListener("scroll",function(){s()}),s()})</script><section id=mark-complete class="hidden w-full flex-col items-start justify-between"><div class="mx-auto w-full rounded-xl border border-green-400 bg-white shadow-lg"><div class="overflow-hidden rounded-t-xl"><div class="bg-green-100 px-10 py-3"><p class="m-0 text-lg font-semibold text-green-700">تهانينا على انتهاء
0 commit comments