The Invoice That Originated from the Wrong Continent
ID: 83e0c2f2-2785-565c-8586-72465e047bd6
STIX ID: report--83e0c2f2-2785-565c-8586-72465e047bd6
Feed Name: IRONSCALES
Threat Score
A targeted invoice-fraud email impersonated a construction consulting firm by fabricating a three-party thread and attaching a PDF invoice with attacker-controlled Wells Fargo routing and account numbers; SPF passed and DMARC returned bestguesspass, but header inspection revealed an x-originating-ip (45.67.97.6) geolocated to Seoul inconsistent with the sender's US location, and the message was flagged by defensive tooling before payment occurred.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.