Thread by @sisinerdtweets

I just received this phishing email and it’s one of the best I’ve ever received.

Some of my frequently taught principles/knowledge points saved me and I’ll be sharing them on this thread even before I begin to do more in-depth analysis.

#Thread

1. The first thing that hit me when I opened this email was fear.

They achieved this with the use exclamation signs, terrifying email subject and use of keywords/threats.

Immediately I felt fear, I manually slowed myself down from taking the action of clicking the button.

2. Generic greeting!

Email starts with “Hi” even my Instagram username isn’t mentioned.

So although the email came from [e-mail] , I could smell a fish…sorry phish 😂

3. I have a habit of not clicking links in emails if I wasn’t expecting it, so I went to confirm on the Instagram app if Instagram actually sent me this mail.

Lo and behold, Instagram didn’t!

The steps to check are Settings > Security > Emails from Instagram

4. Next, I went back to the email, right clicked the button to copy the link behind the “Objection Form” button…WITHOUT CLICKING IT

I pasted the link on my notepad for manual inspection.

It was wrapped nicely with my username, but the TLD gave it away

Side note, I couldn’t even tweet the Top level domain here without Twitter screaming… nice one Twitter.

I’ll do some header analysis and play with the phishing link a bit to understand the TTPs but just thought to let you all know that someone is outchea spoofing Instagram.

#ShineYourEye make you #NoGoFallMaga!