In this video, I want to go over a actual spear phishing email that we received and kind of break down
how it was identified and kind of how you can go through the same process to verify whether something
is legitimate or not.
So this email came in and it's from Cook's Direct.
Ah, um, asking for accounts receivable subject important change affect December 6th, 2024.
This was sent on the second remittance instruction detail.
And it goes on to say good day.
What's the update on this?
Please could you kindly confirm if this has been updated on your payables system?
Please advise.
A deadline is on Friday the sixth.
See below details below.
Let me know if you need to avoid Czech bank letter as well.
And they provide a routing number a bank account number for Cook's Direct Inc.
Uh, it's a checking account for Premier Bank.
They give the bank an address.
Appreciate your help.
They have the cooks logo.
They have accounts receivable, accounts receivable, department phone number, email and the address.
So.
This looks fairly legitimate.
So it it's not some weird email address.
It's actually a domain address.
And the company's is Cook's direct and the emails.
Cook's direct us.
So it's a legitimate domain the legitimate email.
It has the logo.
It has the phone number for the for the company, the office phone number, email.
They provide the address.
They have the logo.
They have a bank routing number, account number.
They have the bank name and the address.
They're very polite and cordial.
However, it's basically you have to update the bank account within four days.
So is this legitimate or not?
Again, on its face it does look pretty legitimate.
So in order to determine this, we can whether it's real or fake, we could do a few things.
Now if it's a if it's going directly to a person or if it's very small business, there is a high likelihood
you're going to know who what type of vendors you're working with.
Now, if it's a slightly larger organization, well, that can get a little bit more murky.
It could be difficult to determine which vendors are which.
There's typically a lot of different vendors, a lot of different departments working with a lot of
different vendors.
So it's kind of hard to keep track of what vendors you're actually dealing with, especially if they're
dealing with, say, subcontractors or anything else.
So before we get into this, I do want to say if you do the same type of process, make sure you use
a dedicated virtual machine and sock puppets.
You want to protect your identity.
Now, right off the bat, there's a few things we could look at here.
Again.
We can take a look at the email address.
And again, this looks legitimate.
Accounts receivable at Cook's Direct us.
It's not accounts receivable at gmail.com or accounts receivable at, uh guerrilla mailers 20 minute
mail, some weird domain email address.
We could see there is a routing number, an account number, a bank, a name and address.
We could see the logo.
We could see phone numbers here.
We could see additional emails and addresses here.
So there's a lot of good information that we could take a look at and figure out whether this is legitimate
or not.
Now one of the first things I like to do is always take a look at the email header.
Take a look at is that email address being spoofed.
And another important thing is take a look at the SPF, DKIM, and dMarc because if these fail, they
should not come through to our email account.
Now, depending on how you or your corporation has their email account set up, a failed SPF marker
or DKIM may still come through even though it shouldn't.
And one thing I have noticed with Google is if Google can't figure out if it doesn't fail or it doesn't
pass, it'll still let it through because it's not sure what to do with that email, which is pretty
bad.
That's that's not what you want to happen.
You want that.
You want that to fail if it doesn't know.
If it doesn't quite fail or pass, you want that email to go to spam or you want it to just get rejected.
However, again, that's the case with Gmail at least.
This may be the same with other email vendors, I'm not sure.
But again, what you want to do is take a look at the email header and especially at the SPF and dMarc.
See if it did pass.
The other thing we want to do is we take a look at the domain.
So we take out the first part, everything before the At symbol and we take the rest.
So Cook's direct us.
We punch this into a Whois lookup and we can see right here domain cook's direct us.
We can see the register.
We can see when it was registered and when it expires.
So typically scammers will take a domain.
They'll buy a domain for one year because that's the shortest that you could buy a domain for.
And we could see a lot of different information other than when it was purchased, when it expires,
how long the lease is.
We could see typically other information.
Sometimes we could see a register name.
We could see that the name here we sometimes see the organization, the street address.
Sometimes we see phone numbers and email addresses and whatnot.
Now, if it's a scam, they're probably not going to use their real information.
If there is anything at all, it's probably going to be bogus information.
However, we still put this into a PayPal search.
We could take a look at reverse phone searches.
We could take a look at Google Maps, take a look at those addresses, and just double check with that.
And again, what we're looking for is we take a look at the domain, we take a look.
And when it expires again you could typically scammers will use a short domain if they didn't take over
someone else's domain or take over account in another domain.
But a one year lease on a domain for a supposed company is usually a red flag.
And why?
Why do they buy domains?
Well, you can get a domain really cheap.
So we could see we could I could buy a dotcom for $11, and in some cases you could buy it for $3.
And if I spend a couple more dollars, say 3 to $5, typically I could buy a domain email to make it
look even more legitimate.
So if I buy, say, Microsoft support.com and I spend $11 for it, well, now I have the domain.
Fantastic.
And I want to buy the Microsoft support email address.
Well, I spend a few more dollars.
I register that email address to my domain, and now I have an email addresses at dimensions, my domain
name for under $20.
And that's good for a year so I can go, you know, spend go after a lot of people on this.
Another thing we could take a look at since we have the domain, is we could take a look at the domain
website.
We could take a look at it on a regular browser.
We could use things like Builtwith to find out what type of technologies were used with it.
We could use some subdomain finder programs to take a look at the subdomains.
We could do Google dorks, see if there's anything else hidden within that that we that we might find
interesting.
We could find passwords.
We could find, uh, documents, PDF files, XLS files.
Google docs is extraordinarily powerful.
When we're doing websites.
I found a passwords and bankroll payroll information using Google dorks.
Uh, looking for PDF files, XLS files, and whatnot.
You'd be amazed at some of the stuff that you can find just doing a simple Google dork, uh, advanced
Google search on these websites.
And since we had some phone numbers, we could punch it into reverse phone number lookups.
Uh, one of my favorite ones for within the United States is spy dialer.
So I will typically put a phone number in spy dialer.
It'll give me typically a name.
If I could find it, it will give me a basic location.
It will tell me sometimes who the phone provider is.
If it's a landline or if it's a VoIP number, I could take a listen to the voicemail if there is a voicemail,
and that's really handy.
I'm not exactly sure how they do it, but they're able to hit the voicemail without actually having
it ring the telephone, which is a cool trick.
And from the voicemail, we might be able to find additional information.
In this case, we did find a possible owner with a name.
And typically what I'll do is any information I found find I will put it through additional searches
and additional search engines to determine whether that that matches up, because finding information
on one site is not always going to be up to date or accurate, so you do want to verify your results.
Another thing we can do is we can take a look at the business registry.
And so Cook's Direct is a Illinois business.
So going to a business entity search I could punch in Cook's Direct in Illinois and it'll give me all
the information file number entity type.
When was it incorporated.
Duration time annual filing.
Who's the agent information.
What's their status?
Is it active?
Is it deactive whatnot?
I could take a look at different filings in the history for that and whatnot.
And this is really handy for determining if this is an actual business or not.
And of course we could do a Google search of Bing search, Yandex search, Baidu whatever to look up
Cook's Direct.
Don't just click on the the link in the in the email, because if it's bogus, it's going to take you
to a bogus site typically.
So we do want to look up the actual Cook Strike website.
And I found it at Cook's Direct.
Um Cook's direct.
Com not.us.
And we could also do things like.
Well we have a bank routing number.
Is that a real routing number.
Well we could use a bank routing number verification service that's online.
And this one goes through LexisNexis.
It's free.
It's pretty easy to use.
You punch it in and it does come back.
And it's indeed a actual bank routing number.
It's a real routing number with Premier Bank.
And it gives the different addresses for for this particular bank.
So that routing number I know is a real routing number, even though the website they provided and the
phone number they've provided is not real.
And of course we can look up the bank, your premier bank com in this case.
And so what do we know at this point?
We know cooks is a real business in Illinois.
The URL is actually cooks direct.com, not us.
The phone number is not they provide is not a business phone number.
And cooks direct us is a essentially a dead page.
But the bank routing number is real.
So what can we do with this information?
Well we can contact support at cook.
Com to verify which I did.
And they they knew right away what I was talking about.
And they said don't don't deal with those people.
It's it's a scam.
Now we could also call Premier Bank to notify them of the fraudulent account, which I did in this case.
They actually didn't want to believe that they had a fraudulent account until I told them that, hey,
this is this is what happened.
The company verified that the other business is fake.
And yeah, they do have a actual account here with you guys.
And here's the bank account and routing number.
And they did verify it.
Well yeah okay.
That is real.
And they sent me off to the fraud department.
I emailed them with information.
You could block the email domain.
You could also contact the police, even though your mileage will vary, whether they're going to do
anything at all or if they're able to do anything in additional steps we could take is we could do I
could do some like say, social engineering, I could email and bank or a, you know, um, I tried
to I tried to process the information.
Could you fill out this form again because I can't find your paperwork and provide a canary token for
them to trigger so I can find their location or IP address and other information potentially.
So this is a walkthrough of a email scam.
How to identify it, the steps that I took to identify it, and I hope this helps you in the future.
Thank you so much for watching.