The email ‘case2.eml’ was opened in Thunderbird. The receiving email address is letsdefendlab@outlook.com. The email was sent from demo@letsdefend.io, but the ‘reply-to’ address is demo@l3tsd3f3nd.io, which could indicate a phishing attempt. Additionally, the subject line ‘Request for Lab Testing Services’ is potentially suspicious due to its call to action (Figure 1).

Severity: Medium

Severity Level: High

Severity Level: Medium

The pcap file ‘case1.pcap’ was opened in Wireshark. I filtered through the network traffic log using the ‘smtp’ filter to examine the email traffic associated with the smtp protocol.

SMTP is a basic protocol for sending email over the internet.

Concept:

Creates an attack surface belonging to the organization in order to produce intelligence specific to the organization.