The CEO’s reply address is a freemail account
Read a user’s mailbox file with grep. Compare From, Reply-To, and Return-Path on each message and find the one where replies would go somewhere other than the sender.
Briefing
tom.reed forwarded a message to the security mailbox: the CEO asked him for gift cards. His mailbox was exported in mbox format, one message after another, each starting with a “From ” line.
From is what the mail client shows. Reply-To is where a reply goes. Return-Path is the envelope sender that bounces go to and that SPF checks.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.