Hello victim email address
Just want to tell you that there is a mistake in this invoice we received from you. I'm providing the copy of it as well as the corrected one below. So, please send me an updated invoice at your earliest convenience.
Click here for details information
Manager Taylor Adam
Phishing link hidden in the content of the message: http: / / invoice0801.2amasonaws.download/read/document/am9obi44bHVlQGdtYWlsLmNvbQ==
Received: from smtpweb126.aruba.it (smtpweb126.aruba.it. [18.104.22.168])
Received: from 899C48.swisscom.com ([22.214.171.124])
Subject: Invoice mistake
From: Manager <firstname.lastname@example.org>
Date: Mon, 15 Jan 2018 15:54:01 +00
Originating IP: 126.96.36.199
Originating ISP: Mt-mpls
Country of Origin: Morocco
Note: swisscom.com is a genuine company, spoofed in this case. The real Swisscom has nothing to do with the fraud/phishing attempt.