Hints

Open them only when stuck, one at a time, and keep count for your self-assessment.

Hint 1

Start with billing-notice.eml in “from-chih-ning”. Is there a link in it? What does it ask Chih-ning to do?

Hint 2

Press “Show original” on the email and look at From, Reply-To and Authentication-Results. Then open the real BeatBird newsletter and compare.

Hint 3

Do as the email says: search MistSearch for “BeatBird Member Centre Official”. The ad addresses all look alike; use “URL check” in Mistport Tools to see the real domain.

Hint 4

When were the fake sites’ domains registered? There is a “WHOIS lookup” bookmark, or type whois and the domain in the terminal.

Hint 5

The fake site’s support page asks you to scan a QR code. Download the image, read it with “QR reader” in Mistport Tools, then compare it with ripple_linked-devices.jpg.

Hint 6

Which address did the scam go to? Check maskmail_aliases.csv, then try “Leaked Yet?”.

Hint 7

In BeatBird’s data-provided.csv, which file has the field avg_sleep_30d? Who downloaded both the file with names and the file with sleep data?

Hint 8

In canary-inbox.txt, which canary received the scam? Match it to a download in canaries.csv, then to a person in downloads.csv.