Skip to main content
Tier One
High

Credential phishing email reported by user — link clicked

A-1041

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
Email Gateway
Detection rule
EGW-PHISH-REPORT-001
Affected user
j.rivera
Affected host
WKS-FINANCE-14
Source IP
185.234.72.19
First seen
2026-07-24T13:04:00Z

Why this fired, in plain English

An employee pressed the 'Report Phishing' button, and the gateway then found that the link inside the email was opened from their computer.

Suggested playbook

Phishing report triage

  1. 1. Pull the message headers. Check SPF, DKIM and DMARC results.
  2. 2. Compare the sending domain to the real domain character by character (rn vs m, l vs I, 0 vs o).
  3. 3. Check the reply-to address — attackers often differ it from the From address.
  4. 4. Run WHOIS on any linked domain. Domains under 30 days old are a strong signal.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T12:58:11Z src="email_gateway" event=message_delivered msg_id="8f21ac" from="payments@northwlnd-mfg.example" to="j.rivera@northwind-mfg.example" subject="ACTION REQUIRED: Invoice portal password expires today" spf=fail dkim=none dmarc=fail attachments=0

    The sender domain is northwlnd-mfg (with an L), not northwind-mfg. SPF/DKIM/DMARC all failed, meaning nobody proved they were allowed to send as that domain.

  2. Guided hint: this line matters

    ts=2026-07-24T13:01:47Z src="email_gateway" event=url_rewrite_click msg_id="8f21ac" user="j.rivera" url="https://portal-northwind-invoices.example/login?u=j.rivera" verdict=uncategorized client_ip=10.20.14.61

    The user clicked the link. 'uncategorized' means the destination is too new to have a category yet.

  3. Guided hint: this line matters

    ts=2026-07-24T13:02:09Z src="proxy" event=http_post user="j.rivera" host="portal-northwind-invoices.example" uri="/login" bytes_out=412 status=302

    An HTTP POST means the browser sent data — here, most likely the typed username and password.

  4. ts=2026-07-24T13:04:00Z src="email_gateway" event=user_report msg_id="8f21ac" reporter="j.rivera" note="I think I just typed my password into this"

Related events

The order things happened in.

  1. 12:58Z

    Spoofed email delivered

  2. 13:01Z

    User clicked the link

  3. 13:02Z

    Credentials POSTed to the fake portal

  4. 13:04Z

    User self-reported

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 5 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.