The same thread, a different domain
An invoice thread changes bank details halfway through. Compare sender domains character by character, follow In-Reply-To, and find the lookalike that slipped into the conversation.
Briefing
Thread hijacking starts with a real conversation, often taken from a compromised mailbox at the supplier. The attacker replies in the same thread from a domain that looks identical at a glance.
Accounts payable nearly paid it. The thread is exported to ap-thread.mbox. A capital I and a lowercase l look the same in most fonts; grep and cut do not care about fonts.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.