Email apparently from Manager <no-reply@updates.swisscom.com> - Invoice mistake:
Hello victim email address
Just want to tell you that there is a mistake in this invoice we received from you. I'm providing the copy of it as well as the corrected one below. So, please send me an updated invoice at your earliest convenience.
Click here for details information
Best wishes,
Manager Taylor Adam
Phishing link hidden in the content of the message:
http: / / invoice0801.2amasonaws.download/read/document/am9obi44bHVlQGdtYWlsLmNvbQ==Return-Path: <86AB6F7@swisscom.com>
Received: from smtpweb126.aruba.it (smtpweb126.aruba.it. [62.149.158.126])
Received: from 899C48.swisscom.com ([105.159.233.236])
Subject: Invoice mistake
To: victim
From: Manager <no-reply@updates.swisscom.com>
Message-ID: <1.1.91C31288950D0E8E65.B@swisscom.com>
Date: Mon, 15 Jan 2018 15:54:01 +00
Originating IP: 105.159.233.236
Originating ISP: Mt-mpls
City: Casablanca
Country of Origin: Morocco
Note: swisscom.com is a genuine company, spoofed in this case. The real Swisscom has nothing to do with the fraud/phishing attempt.