Introduction

The “PhishStrike” scenario immerses you in a cybersecurity investigation where an educational institution is targeted with a phishing email. The attacker impersonates a trusted contact to bait faculty members into downloading a malicious file, purportedly an invoice for a $625,000 purchase. Leveraging tools such as Email Header Analyzer, URL Haus, and other threat intelligence platforms, this lab walks you through the analysis of email headers and URL-based malware to uncover Indicators of Compromise (IOCs). This exercise aims to deepen your understanding of phishing tactics, the use of SPF/DKIM for email validation, and effective threat mitigation strategies.

Analysis

Q1 Identifying the sender's IP address with specific SPF and DKIM values helps trace the source of the phishing email. What is the sender's IP address that has an SPF value of softfail and a DKIM value of fail?

Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are email authentication protocols that enhance email security. SPF verifies that a mail server is authorized to send emails on behalf of a domain, while DKIM ensures the integrity of the email content by using cryptographic signatures. In this case, analyzing the headers reveals that the sender's IP address is 18.208.22.104, which has an SPF value of “softfail” and a DKIM value of “fail.” A “softfail” in SPF indicat