32 Hertz SOC Global Guardians logo

32 Hertz SOC

Phishing Investigations, Part 3: Building a Campaign Fingerprint

32 Hertz SOC Global Guardians logo

Written by

edmalaker

in

This article continues Phishing Investigations, Part 2, where I sorted the suspicious messages and developed a working theory about the campaign.

To begin the technical analysis of the emails I have labeled the “John Doe” messages, I created a table in my private database. A spreadsheet would work just as well, but I wanted one place where I could compare the same details across every message.

I am keeping the actual addresses, domains, message identifiers, and links private. Publishing those values could expose personal information or encourage someone to open a potentially dangerous URL. The purpose of this article is to document my investigation and reasoning, not to publish the raw evidence.

Building the comparison table

For each email, I recorded the following fields:

  • Date received
  • Sender email address
  • Sender domain
  • Microsoft tenant ID and tenant domain
  • Subject line
  • Exact lure text
  • URL
  • Subdomain
  • Root domain
  • Message ID

Once I entered the messages, I compared the rows to see whether any values repeated.

What I found

The first result was a little disappointing because most of the obvious indicators were unique:

  • Each message used a different sender email address.
  • Each sender domain was different.
  • Each Microsoft tenant ID and tenant domain was different.
  • Each subject line was different, although every subject promised pictures.
  • The wording changed, but every lure used pictures from the past to create curiosity or nostalgia.
  • Each message contained a different URL and subdomain.

The Microsoft authentication-source values were also unique. However, they all ended in prod.outlook.com, and two shared the longer ending LAMP152.PROD.OUTLOOK.COM.

At first glance, I thought the Outlook suffix might mean that each message came from a compromised Microsoft 365 account. After checking that assumption, I realized the evidence does not support that conclusion yet. The suffix shows that Microsoft-hosted mail infrastructure was involved, but it does not tell me whether the sender used a compromised account, an attacker-created account, an abused service, forwarding, or some other type of relay.

That correction matters. A good investigation has to separate what the evidence shows from what the investigator suspects. Before I can make a stronger claim about the accounts, I need to compare the full message headers, including the SPF, DKIM, DMARC, and composite authentication results described in Microsoft’s message-header documentation.

The campaign fingerprint so far

Although I did not find a simple repeated address or domain, I can still see the outline of a campaign fingerprint:

  • The sender identities and technical indicators change from message to message.
  • The lure consistently promises old pictures or memories.
  • Microsoft-hosted mail infrastructure appears in the routing information.
  • The links look disposable because every message uses a different URL and subdomain.
  • The campaign has continued over time, with another message arriving roughly every three to four days.

This does not identify the person or group responsible. It also does not prove that every message came from the same system. It is simply my current working theory based on the behavior I can observe.

My next step

The sender information did not give me enough to solve the mystery, so my next step is to investigate the link infrastructure. For each link, I plan to add these fields to my private database:

  • Root domain
  • Domain creation date
  • Registrar
  • Nameservers
  • First-seen date
  • Current IP address
  • Historical IP addresses
  • Autonomous system number (ASN)
  • TLS certificate details
  • Redirects
  • Final destination and final root domain
  • URL path
  • URL query parameters

I will collect this information through passive research whenever possible. I will not open the suspicious links directly in my everyday browser. I will also remove personal information before submitting any indicator to a third-party analysis service, because some services retain or share submitted data.

What I hope to learn

The individual domains may be unique at the surface but still converge deeper in the infrastructure. For example, several unrelated-looking domains might use the same nameservers, hosting provider, tracking service, certificate, IP history, or final destination. A repeated connection like that would be a stronger clue than the shared lure alone.

It is also possible that the research will not reveal a connection. That would not make the investigation a failure. It would mean the current evidence is not strong enough to confirm my theory, and I would need to document that result instead of forcing an answer.

This part of the investigation is still open. It will take time to research the domains and compare the results safely. In the next part, I will share what I find, explain which connections appear meaningful, and decide what to investigate next.

Until next time!

More posts