Project details
Phishing Investigation
Phishing infrastructure and suspected mailbox compromise
Investigated a QR phishing lure and suspected Microsoft 365 mailbox compromise, bringing together email headers, sign-in records, document artifacts and phishing infrastructure observations.
The report connects evidence to a timeline, assesses competing explanations and sets out prioritized follow-up work. Documented findings are separated from hypotheses, with account compromise and downstream impact left unresolved where evidence is incomplete.
- Email authentication and QR lure analysis
- DNS, certificates and network observations
- Evidence catalog and incident timeline
- Confidence assessments and response recommendations
Need something like this in your business?
Less panic. More proof.
One suspicious email can produce twelve confident theories. The useful habit here is to build a timeline, connect each claim to evidence and make the unanswered questions visible.
Let’s talk about your versionPicture it in...
Supplier payment changes
The same approach could compare messages, account activity and timing when a request to change bank details looks suspicious.
Service disruptions
It could bring scattered logs and team reports into one account of what happened, what is known and what to check next.