This is a continuation of Phishing Investigations, Part 4.
In this next part of the investigation, I am going to take a look at the timestamps to see if there is a pattern we can identify that might be helpful.
I looked through each of the emails I received. Inside each one was an “On [date/time], John wrote:” line, so I saved and compared those times as well. It is important to note that this line is part of the message body, not a trusted email-header timestamp. The sender can create or change it, which is one reason a repeated difference may be useful as a campaign pattern.
What I Found
In the sample I reviewed, using one consistent timezone:
- The emails arrived every other day, but only Monday through Friday.
- The emails always arrived before 1 p.m.
- The inner quoted timestamp was always two hours and seven minutes earlier than the actual send time.
The repeated timestamp difference may be a fingerprint of automation or a reused template attempting to make each email appear to be a reply to an earlier message. It is a useful clue, but it does not prove how the messages were created.
The arrival times might also point to an interesting clue. Since the messages arrived before 1 p.m. and not on weekends, could that reflect someone’s working hours? Possibly, but it could also result from an automated schedule, batching, or a different timezone. The timing alone does not prove when or where the attacker is working.
Interesting Update
I was going through some of my old records and noticed that I had older messages from “John Doe,” showing that this pattern had been reaching me for quite some time. These messages had the same two-hour-and-seven-minute timestamp difference.
However, the older messages showed a slight difference in how the links were composed. This could mean that the campaign has changed over time, although the link difference alone is not enough to prove that the same operator created every message.
I also received a message using another name familiar to me that followed the same campaign pattern, including the timestamp difference. I am not sure whether the campaign is switching to this new name or will continue using both, but I will keep watching and documenting what appears.
Next, I will look at the sending email addresses, which I had planned to do this time before the timestamp pattern caught my attention.
See you next time!