Synthetic demo case · C-0003
Suspicious message with failing authentication
A message that fails SPF and DKIM, carries an attachment named like a PDF that is really an .htm file, and asks the reader to act quickly. Nothing in it is fetched or opened.
- Evidence
- Email message (EML)
- Findings
- 8 (highest severity high)
- Events
- 2
- Stated unknowns
- 12
Findings and citationsClient reportPhishing email analysisAll demo cases