A user forwarded this message to the security mailbox — triage the headers and state the verdict.
You are on first-line incident triage. A user forwarded a suspicious message with full headers.
Constraints:
- Judge only from the header block below — do not open links or attachments.
- Give a verdict and name the specific header evidence behind it.
Received: from mail.deliv-svc.net (198.51.100.44)
From: "Billing Department" <billing@paypa1-secure.com>
Reply-To: refunds-desk-77@mail.example.net
Authentication-Results: mx.corp.example;
spf=fail (sender IP is not permitted) smtp.mailfrom=paypal.com;
dkim=none header.d=paypal.com;
dmarc=fail (p=reject) header.from=paypal.com
Subject: Your invoice A-7741 is overdue - act within 2 hoursName the phishing indicators and the immediate response actions.
SPF, DKIM and DMARC all fail for the claimed sender, so the From header is forged. The display name reads Billing while the domain is a lookalike, paypa1 with a digit one, Reply-To points elsewhere, and the subject manufactures urgency. Keep the raw headers.
- ✗Assuming delivery to the inbox means the message passed authentication
- ✗Reading a lookalike domain as a legitimate partner or delivery subdomain
- ✗Deleting the message before the raw headers are preserved as evidence
- →What would you search for to find who else received the same campaign?
- →Why is the email-authentication policy
DMARCset to reject on the spoofed domain relevant here?
The message is phishing, and the headers alone prove it.
spf=fail -> the sending IP is not authorised for paypal.com
dkim=none -> no signature, so the From header integrity is unverified
dmarc=fail -> the domain owner asks receivers to reject such mail
From: -> paypa1-secure.com, a lookalike (digit 1 instead of letter l)
Reply-To: -> an unrelated mailbox, so replies never reach the sender
Subject: -> manufactured urgency, act within 2 hoursResponse order: preserve the raw headers and the message file as evidence, search for every other recipient of the same campaign by subject and sender domain, purge the message from mailboxes, block the lookalike domain, and check whether anyone followed the link. If somebody did, this stops being message triage and becomes an incident with possible credential compromise.
