INCIDENT_RESPONSE

FORWARD PHISHING

Attach the original. Headers matter.

do not click the bait — forward the whole message

pick a client back to the roof
SEND_TO :: phish@localhost STANDING_BY

> plain Forward rewrites headers. use attachment / .eml

gmail (web)

  1. open mail → ⋮ → Show original
  2. Download original (.eml)
  3. new mail → attach .eml → send to address above

optional: ⋮ → Report phishing (to Google)

outlook

  1. select message → right-click / ⋯ → Forward as Attachment
  2. classic: Home → More Move Actions → Forward as Attachment
  3. no option? Save/Download .eml/.msg → attach to new mail

apple mail

  1. select message → Message → Forward as Attachment
  2. or drag message to Desktop (.eml) → attach

thunderbird

  1. Message → Forward As → Attachment

phone

  1. headers often stripped — prefer desktop / gmail.com in browser
  2. gmail app: use browser Show original, or Report phishing
  3. iOS Mail / Outlook mobile: forward if you must, then redo from a computer

> ready. mess with the phish,