An invoice from a domain one letter off
A user reported an invoice that looks like it came from a supplier. Compare the sender domain with the real one in DNS and find where its mail and links really go.
Briefing
Accounts payable forwarded a reported message to you. It asks them to update the bank details for Northwind Traders, a real supplier.
The real supplier uses northwind-traders.example. Lookalike domains swap letters that look alike, like i and l. DNS and registration records show who runs the domain and how new it is.
soc-ws · DNS investigation
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.