What is Phishing attack / phishing email
Phishing email, or phishing attack, is tricking people into telling you confidential information (password, social security number, credit card number, bank login information, address, date of birth, etc.). It could be in form of a phone call, website, email. They will will pretend to be someone or something the person normally would give confidential information to.
The sample below that I got from my work email, it’s trying to be from our HR/Payroll (Human Resources) department. It’s an email with Promotion_letter.docx Microsoft Word file attached.
LETTER FOR PROMOTION AND SALARY INCREMENT
Dear Huy ***,
Following a thorough review of your performance, skills, and commitment to our values. We are pleased to inform you of your promotion and your corresponding increase in your salary under the terms of this change.Kindly scan the QR-Code below with your smartphone camera to review document.
The QR code is the link to fake Microsoft / Exchange login page. The URL uses Cloudflare R2 Public Buckets service, which is r2.dev . Cloudflare R2 is a cloud object storage service similar to Amazon AWS S3, and phishing and scam URLs abusing Cloudflare services using pages.dev and workers.dev domains.
Internet headers:
X-Vipre-Scanned: 621A132001AC08621A146D
Received: from CH4PR03MB7721.namprd03.prod.outlook.com (2603:10b6:610:245::21)
by BN9PR03MB6169.namprd03.prod.outlook.com with HTTPS; Mon, 7 Oct 2024
18:31:34 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;
b=YDoKEAtNw8euB1x59SMJoHE9Oc+/VEDwKBwLv6Z47udfx1skVSOFD5/uHq1zPPauFtIs8I/Z9+d7SRjU0h9Xw7lxVl05iPXPGBMZJ6Cdgo9Z5LeEqBY6wPQoCCXpGS4Us3uvIDSeAopm94LU7yIAuAaaIaMkzgQQHAtbLVMYbcSzdesXL4jrEEpy7IFgevrKlt5GQGH6+mS5TqEc3uGB9elQSPV8uwkrUSec+4E6f4RwKs0sCzPng/3LlCymuOrhx6PmRKr0KtlF4cPKmxKat9R253M3BQVF5UcUPzRVY7K6FaSxPRnFXCO6fqgvWZVCZxLk2LHx/FKDJzZH5lcs1Q==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=kKpq6Ldn07aN5TSUUHaLa9wpW2lySl6d2GGfuWZm5QA=;
b=Dz0sJ0nwpR9FjQgKnTckIu7XGfqTTJ3h7ruy3RcOfjyydHYlFT/hRr82pOpoqRV2CcQp+3/kQtAfx9OVmqMrWVp5YPeeV0p1XiuPTyR6KF5B6Bo7oSjNrJM7P6dvsEg5kuHTygLjd/qgjWo3P/55jjQBI6WV6iIEByPkhq1++FTmdoyuLidMQ8iiTifFa3eBLmKgnTaC3BHgHDkGjGG/5yzv8QIsiR9OsULs9MNB8u2sOqw52siGNigiDrVMV5Kvw/c258UvW7YK3+FrGAdsH9CFLjypVdOrQEIFbERyqpEBIqzRUA63qRE9w4440p/ETzvZ8OFrc0waHXfjwGbT4w==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
40.107.96.105) smtp.rcpttodomain=**********.com
smtp.mailfrom=honeybadgerhvac.com; dmarc=bestguesspass action=none
header.from=honeybadgerhvac.com; dkim=none (message not signed); arc=pass (0
oda=0 ltdi=1)
Received: from BN9P220CA0003.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:13e::8)
by CH4PR03MB7721.namprd03.prod.outlook.com (2603:10b6:610:245::21) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.23; Mon, 7 Oct
2024 18:31:30 +0000
Received: from BL6PEPF0001AB4D.namprd04.prod.outlook.com
(2603:10b6:408:13e:cafe::9d) by BN9P220CA0003.outlook.office365.com
(2603:10b6:408:13e::8) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.23 via Frontend
Transport; Mon, 7 Oct 2024 18:31:30 +0000
Authentication-Results: spf=pass (sender IP is 40.107.96.105)
smtp.mailfrom=honeybadgerhvac.com; dkim=none (message not signed)
header.d=none;dmarc=bestguesspass action=none
header.from=honeybadgerhvac.com;compauth=pass reason=109
Received-SPF: Pass (protection.outlook.com: domain of honeybadgerhvac.com
designates 40.107.96.105 as permitted sender)
receiver=protection.outlook.com; client-ip=40.107.96.105;
helo=NAM02-SN1-obe.outbound.protection.outlook.com; pr=C
Received: from NAM02-SN1-obe.outbound.protection.outlook.com (40.107.96.105)
by BL6PEPF0001AB4D.mail.protection.outlook.com (10.167.242.71) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8048.13 via Frontend Transport; Mon, 7 Oct 2024 18:31:29 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=E2mtl0ZbqJI7THWlOLXFuDWasICVj4f+9Th4W/zYeNWPKqxaPm5yUv/f55Vx857LiPZBxdNcDLduUrc0kNxfYa8nT7XVEtAsVoIzcB199g4ZJZ+yKswzzDj8XnWYFUBmSMh00LNzsEEuMUwp8vST35z5s2L8RW53RUXCX+uDcLvBIE/Jd3BzCU0p37jMES4sY4jY+PIdUBk/81dLGc/Mi9WHGf+G9zprOEmEjYQctFlCD7nrzP5saBxSp7UGSjkF0Wq/lK/PAkgbBPlz6kLDWPPt264tkjf2fQyUBjHSO/Eh1Kcr5Q8eleyMJ8QczuJr3pNpy4+JY6/3hG/St2OxFw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=kKpq6Ldn07aN5TSUUHaLa9wpW2lySl6d2GGfuWZm5QA=;
b=CCbfc1J05OeynLJCnSdYiRbBftpyQoeKqAyhUP3w2er+ic3KfT4FJDE5ANkvs7d+8ub1uRCZHQaS6+9k3oJ/j8lElaG8cQZUzIssaCZgckq0Zrg+lMGXfOUQzhFCetuSpe5yMLQVxYtF26Ub2YY9Vuyr2dX0nttzjzSXRGWc6iwekeZUKQp971g5Md+icVlppB4t6wrVHC+iXDAbiKuBtrvOBHFQGqHubesk6ev54bg2HZ7+g+BkP6impB21oiuAaTPCAHBNgkH6DRlMpj9v4OvBPg1l4NGr6A/1H7ziv3qrJFkOwaFB8PnGQIyJLxb0c8Lhy6OFyHAs8W1x64g/wA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
103.153.182.115) smtp.rcpttodomain=**********.com
smtp.mailfrom=honeybadgerhvac.com; dmarc=none action=none
header.from=honeybadgerhvac.com; dkim=none (message not signed); arc=none (0)
Received: from PH0PR07CA0003.namprd07.prod.outlook.com (2603:10b6:510:5::8) by
SJ0PR17MB5934.namprd17.prod.outlook.com (2603:10b6:a03:438::5) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8026.20; Mon, 7 Oct 2024 18:31:27 +0000
Received: from CY4PEPF0000E9CF.namprd03.prod.outlook.com
(2603:10b6:510:5:cafe::bb) by PH0PR07CA0003.outlook.office365.com
(2603:10b6:510:5::8) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.23 via Frontend
Transport; Mon, 7 Oct 2024 18:31:27 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 103.153.182.115)
smtp.mailfrom=honeybadgerhvac.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=honeybadgerhvac.com;
Received-SPF: Fail (protection.outlook.com: domain of honeybadgerhvac.com does
not designate 103.153.182.115 as permitted sender)
receiver=protection.outlook.com; client-ip=103.153.182.115; helo=512a6c32;
Received: from 512a6c32 (103.153.182.115) by
CY4PEPF0000E9CF.mail.protection.outlook.com (10.167.241.134) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8048.13
via Frontend Transport; Mon, 7 Oct 2024 18:31:26 +0000
Content-Type: multipart/mixed; boundary="===============9060332782585769590=="
MIME-Version: 1.0
From: =?UTF-8?Q?HR/Payroll?= <[email protected]>
To: huy.******n@**********.com
Subject: =?UTF-8?Q?New document received?=
Date: Mon, 07 Oct 2024 18:31:25 -0000
Message-ID: <[email protected]>
X-Accept-Language: en-us, en
X-Priority: 2
X-MSmail-Priority: High
Importance: High
Return-Path: [email protected]
X-EOPAttributedMessage: 1
X-MS-TrafficTypeDiagnostic:
CY4PEPF0000E9CF:EE_|SJ0PR17MB5934:EE_|BL6PEPF0001AB4D:EE_|CH4PR03MB7721:EE_|BN9PR03MB6169:EE_
X-MS-Office365-Filtering-Correlation-Id: 9e064323-b67b-4354-f027-08dce6fe4304
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted:
BCL:0;ARA:13230040|376014|61400799027|36860700013|82310400026;
X-Microsoft-Antispam-Message-Info-Original:
=?us-ascii?Q?skrubVgi4YKehrKA3NJBnImkMULUvx2CuVdnZGPw7uj2DgLDeEv1abmXYzMG?=
=?us-ascii?Q?fyclZ8A9F/OFYVm5Ky9kyYEtuccsZXICTkQ4JPSKVGehCJdH0oHy3thJaI7M?=
=?us-ascii?Q?O8uaCsJbAnx14qb/wU0+FE7AYYUxsU27y4YhCLZRZBYT8LywROVNvOeSrBCq?=
=?us-ascii?Q?Rb4uVEvSC/PxXKWsHAX4aTDsfc8NRRseZI/iIw3R5ybWS5p6yrkieO2p2LyY?=
=?us-ascii?Q?+rinIPiBUuvp4SeLx0AlENoJOZO5eyUEDgToK7mzyLw+vg6HT54PRIkDDgQU?=
=?us-ascii?Q?OKxrm+h6HXh2ArH9ia4IBp1Y9bYSQ/dkaOGXhGi0s5TcSFqUATSppmkbwSRq?=
=?us-ascii?Q?1nXqwew3QkVDOB6h6EbEAAY5svZzmz8bW6JbrCJBDqNz3uhsQCD9ZMQSxqGB?=
=?us-ascii?Q?bi3/pOONS805ZZTkpDXK/GNqcz7h5IsN7W9W6FCB0aIAIB2YEVfHeOp5A7jD?=
=?us-ascii?Q?SEUZthRrjh2hZUqUewZk4my6E1x3j1Xh4toXq0VQR9+hmaJcUGSQ0+LUShe0?=
=?us-ascii?Q?i0KAIfJQM8Pgl1IEKMNUtX8ZOMATTbUpiHnJr42j8GLt8FM4TQ55dDedA5TQ?=
=?us-ascii?Q?A3IgsfVW9v1HcTK5SdYlOHc7l9DL52CzJ6AGQUTNYDA5J9oJS9dbXJDYrF96?=
=?us-ascii?Q?erYgRsZyzO/zq0sstdSVfU0NGJfTFlV69tlLbCZKRybTbJtnUczXo+PFn0MD?=
=?us-ascii?Q?lx3nNmr7+Jpn47gq5BfFbIOb3WQcI7Ftr7zbikEBAmSrTQtRuAdqZv6HayTG?=
=?us-ascii?Q?ltTWuiq0iaXuESu1eJjnwcsw5qptE2uL1UTbthfUqvi1SQ8IpJu6MGY1KCdU?=
=?us-ascii?Q?Ytm6dyI+TD+yhIfbAU8pQOPAA3VJdQhtVVEpUWqRrfRiwwVn9DnCIJ/jvbtg?=
=?us-ascii?Q?2HO67+7W5N5eibJOfvbPqq9P8S8m4NCTx296uJzHhvUmmWFBuEUJQTVLko+1?=
=?us-ascii?Q?kWtPS3gg+SVnBv/EVxDDIF+6d5GNnM/WwNy8Nqy/oBe2WKIgSzFzuH47qe4b?=
=?us-ascii?Q?x0/ogSFTXcr8XW+Vrr87E9uCZ+SMVwC/T8t1rueEkxI9Xtc=3D?=
X-Forefront-Antispam-Report-Untrusted:
CIP:103.153.182.115;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:512a6c32;PTR:nobele.vaginant.com;CAT:NONE;SFS:(13230040)(376014)(61400799027)(36860700013)(82310400026);DIR:OUT;SFP:1102;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR17MB5934
X-MS-Exchange-Organization-ExpirationStartTime: 07 Oct 2024 18:31:30.0246
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
9e064323-b67b-4354-f027-08dce6fe4304
X-EOPTenantAttributedMessage: d2ef9178-2412-4a3d-847e-e3fd2509e54e:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
BL6PEPF0001AB4D.namprd04.prod.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
BL6PEPF0001AB4D.namprd04.prod.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource:
BL6PEPF0001AB4D.namprd04.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs:
23052577-0286-4cb2-96ff-08dce6fe4139
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam:
BCL:0;ARA:13230040|3072899012|2092899012|12012899012|12062699021|35042699022|2722699018|43540500003;
X-Forefront-Antispam-Report:
CIP:40.107.96.105;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM02-SN1-obe.outbound.protection.outlook.com;PTR:mail-sn1nam02on2105.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(3072899012)(2092899012)(12012899012)(12062699021)(35042699022)(2722699018)(43540500003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2024 18:31:29.7590
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 9e064323-b67b-4354-f027-08dce6fe4304
X-MS-Exchange-CrossTenant-Id: d2ef9178-2412-4a3d-847e-e3fd2509e54e
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bed5a472-8a01-41de-9a5f-7c7716ca4510;Ip=[103.153.182.115];Helo=[512a6c32]
X-MS-Exchange-CrossTenant-AuthSource:
BL6PEPF0001AB4D.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH4PR03MB7721
X-MS-Exchange-Transport-EndToEndLatency: 00:00:04.9553971
X-MS-Exchange-Processed-By-BccFoldering: 15.20.8026.020
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?rsYjJAdP2hQ88HtvwIjs7dJ1Uoe0efupWiGNaUiPkEbjOk3bMZN/e2npTdJm?=
=?us-ascii?Q?CJ6IUm6AIfduA+ViBo0nRi14Dc/yrhj5UvSs0emVhBhpa7RgP3HEzU6yu0PV?=
=?us-ascii?Q?b8l9jmBrtWXq/p7ch0oOX2+HlutBeGDN4E+QpI8ZR+VDRclWMkDc4SHluNZ2?=
=?us-ascii?Q?oSRMZn0juCbdDgWLmbbG0iUWOQJ0an79+8oQFoGSEE/GbXAzNkmRA1JgSa0r?=
=?us-ascii?Q?WNN159aO75Di4QCFNAC/BygR+xfOvgr0Zl0mDpSaSbkDKXdmdbY7yT+H+bIW?=
=?us-ascii?Q?icMnB+Ep+A3TMZaO345GdS4UZa7gEOSmCmTtip1aqHKGcwC/oQc7CTYyt/nk?=
=?us-ascii?Q?TP4+ET3jeoX1SOSQL9RyMQXFM62u48TyvHrFSdpEqFdQMpCBlet5Sn/Aiffh?=
=?us-ascii?Q?/PFzzjio/Adou2CahsG6Mza/4nlXvMuBe24ea55XqZT1NFMFVreBvC3ilFEi?=
=?us-ascii?Q?mwHIlqkRNyDYC/dH3e/xMMyBw6AbQVrZXay+uiPfnQiWKknnpCrhzdx2bbiu?=
=?us-ascii?Q?d5at+OmujLlRKva9iLmtvrLL8Y90DnHBiF4ANypk/6m2udX6IZ08J8+V5Ab3?=
=?us-ascii?Q?e4v+3KyZEvzKmt6hLb6t9xp/UA6xz+8KW3o0a/huGk3vExj43UeAHrE6ID26?=
=?us-ascii?Q?XrnFbhD/r9AN6xDgJEs3ER0Pm0hyGmoVwtj8lTkNq1y4tcKOxXgxTj6rSXE+?=
=?us-ascii?Q?pRfc23oHHIk0e2d4FosE8Si5dfh/9wpeO64GFK7QbaeilJ07jJYP5caT46z/?=
=?us-ascii?Q?9IFPa/Wz1NF8hzmqz491t/uYc+E4uE5D+y+xZ2RmLMfGhr0juGiTX42uI7wm?=
=?us-ascii?Q?T6K9FXUUEl/pCzg5fFvMESdCbwLlRfP7V2UmMvaZNyaMITmZDLcdcwNP7qfT?=
=?us-ascii?Q?ALBwhOiJmXw84Dt6fYPNDk5z7yfKMGTXfZKecPdMweNcMPbVceOknZFxYgO7?=
=?us-ascii?Q?Ol3Oo9MrRt+SljrrIGgtAPSmYfpsUqSxkNNLdkEYEi2groY/Em+BSG7MkCmL?=
=?us-ascii?Q?IQ8kYWa2oVQJVamA/CIfuv5mtWVtR9g7f6mDDYJ7kFlraPN5MEBkqNB6nqfn?=
=?us-ascii?Q?MliRRJZ0Q2Hkmt+PZsFHMgHMaGUVPNiFPDdkpozI24V92gWrc00btiy2eNIy?=
=?us-ascii?Q?egrzl4YbkGEkgSRv1veimy3JA7w7dTX5B2KL23Dsm+/f3TfB2hBYZjtrmDbT?=
=?us-ascii?Q?37jd3Xe35VQMCuyZ5t2UezkPxitkqhhiR7CqUwf3UyNL7FVAoR+YoztDbWQL?=
=?us-ascii?Q?7u9cIp2KB3G9XS2tceVYv4rcP53RHIOMuZA5n4JQr/e2d1QXm6uKTp7tqBRx?=
=?us-ascii?Q?j3/bvJmKUI0frdk0BYf6NJn+bY7uZAkBHJQrt7el5Z+5AFy3OKZMPHMYM/JA?=
=?us-ascii?Q?3yF2wQIiHcUCVgo1MMzpuNkNpcwOViV4qQ1wjirvtVhw6eGUFn16E9iYmiPy?=
=?us-ascii?Q?5X02AQwaC9QOaC/KFMs+zOp0L2dqcD/vQ7eQvmU4ZANznqBNhGNP2CmGAUUv?=
=?us-ascii?Q?inyoegblRmZMQxGFWLKs56/+jP7PicuA4KxQJlt91yNlYk6MZKS+STBos7Fl?=
=?us-ascii?Q?Pefcj27vwK3jdix9wglt2mqPUxe5ZUM8kGN2m4xXrB9N5cNBmvNmFRVKQhWc?=
=?us-ascii?Q?Zus/uKpT0futNFO40Vfzj4N+cW8qH49YLMauusZLe4s2z937cfdpuPY1T2v/?=
=?us-ascii?Q?1gy27g=3D=3D?=