\documentclass[11pt,a4paper]{article}

\usepackage{fontspec}
\setmainfont{Helvetica Neue}
\setmonofont{Menlo}

\usepackage[a4paper,margin=2.2cm]{geometry}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage{longtable}
\usepackage{array}
\usepackage{tabularx}
\usepackage{enumitem}
\usepackage{fancyvrb}
\usepackage{fvextra}
\usepackage{graphicx}
\usepackage{float}
\usepackage{caption}
\usepackage{fancyhdr}
\usepackage{titlesec}
\usepackage[most]{tcolorbox}
\usepackage[hidelinks]{hyperref}

\definecolor{darkblue}{HTML}{1F3A5F}
\definecolor{accent}{HTML}{B23A48}
\definecolor{lightgray}{HTML}{F4F4F4}
\definecolor{midgray}{HTML}{6E6E6E}

\hypersetup{colorlinks=true,linkcolor=darkblue,urlcolor=darkblue}

\titleformat{\section}{\Large\bfseries\color{darkblue}}{\thesection}{0.6em}{}
\titleformat{\subsection}{\large\bfseries\color{darkblue}}{\thesubsection}{0.6em}{}
\titlespacing*{\section}{0pt}{1.4em}{0.6em}

\pagestyle{fancy}
\fancyhf{}
\lhead{\small\color{midgray}Phishing Incident Analysis Report}
\rhead{\small\color{midgray}CONFIDENTIAL}
\cfoot{\small\color{midgray}\thepage}
\renewcommand{\headrulewidth}{0.4pt}

\newcolumntype{L}[1]{>{\raggedright\arraybackslash}p{#1}}

\newcommand{\hl}[1]{\textcolor{accent}{\textbf{#1}}}

\setlength{\parindent}{0pt}
\setlength{\parskip}{0.5em}

\begin{document}

%==================== COVER ====================
\begin{titlepage}
\vspace*{2cm}
\begin{center}
{\color{accent}\rule{\textwidth}{2pt}}\\[0.8cm]
{\Huge\bfseries\color{darkblue} Phishing Incident Analysis \& Case Summary}\\[0.5cm]
{\Large Credential-Harvesting Attack Against OK Group Staff,\\ Delivered Under an Abused HPE Email Identity}\\[0.6cm]
{\color{accent}\rule{\textwidth}{2pt}}\\[1.5cm]

\begin{tabular}{rl}
\textbf{Report ID:} & IR-2026-0827-PHISH-OKG \\[4pt]
\textbf{Incident type:} & Phishing / Credential harvesting / Email-identity abuse \\[4pt]
\textbf{Severity:} & \hl{High (email passed DMARC authentication)} \\[4pt]
\textbf{Target:} & OK Group / OKX staff (recipient's personal mailbox) \\[4pt]
\textbf{Report date:} & 2026-08-27 \\[4pt]
\textbf{Status:} & Initial open-source (OSINT) analysis complete \\
\end{tabular}

\vfill
{\small\color{midgray} This report is based on analysis of the raw headers of the email received\\
by the victim, plus passive reconnaissance (OSINT) of the associated domains,\\
IPs, certificates and public services. All findings were obtained WITHOUT any\\
intrusion, scanning or unauthorized access to attacker-controlled systems.\\[0.3cm]
Intended uses: internal notification, filing a police report, notifying the\\
OK Group security team, and submitting abuse reports to AWS / registrar / host.}
\end{center}
\end{titlepage}

\tableofcontents
\newpage

%==================== 1. SUMMARY ====================
\section{Executive Summary}

On 26 August 2026 (UTC), the victim's personal Gmail mailbox received a Chinese-language phishing email impersonating the HPE (Hewlett Packard Enterprise) IT security team, with the subject \hl{``Security Notice: Employee Account Re-registration Reminder.''} Using the pretext of an ``internal security system upgrade requiring all staff to re-register within 24 hours,'' it lured the recipient to click a link.

Three unusual characteristics make this incident far more dangerous than typical phishing:

\begin{enumerate}[leftmargin=1.4em]
\item \hl{The email is cryptographically ``genuine.''} It was sent through Amazon SES carrying a valid signature from a DKIM key \textbf{that was actually published in \texttt{hpe.com}'s DNS at the time}. As a result SPF, DKIM and DMARC \textbf{all passed} --- even though \texttt{hpe.com} enforces the strictest \texttt{p=reject} policy. Gmail therefore delivered it normally with no warning. This is not ``sender spoofing''; the attacker \textbf{obtained the ability to sign mail as HPE}.

\item \hl{A subdomain sleight-of-hand hides the real target: OK Group.} The email body displays the link as \texttt{engine.okg.com} (appearing to be a legitimate OK Group domain), but it actually points to the attacker-controlled \texttt{okg.enginelark.com}. The email hot-links OKX's genuine brand logo from OKX's real CDN, leaving no visual tell.

\item \hl{The attack shows targeted reconnaissance.} The look-alike domain \texttt{enginelark.com} maps precisely to OK Group's real internal system codename (``Engine'' office portal + ``Lark''/Feishu), and the phishing page hard-codes OK Group's genuine internal domain \texttt{enginelark.okg.com} as a fallback redirect. This indicates deep knowledge of the target's internal naming --- not indiscriminate mass mailing.
\end{enumerate}

The phishing page requests the victim's \textbf{corporate email and a verification code} (not a password), consistent with session hijacking or OTP relay, which can bypass some two-factor authentication (2FA). During analysis, at least \textbf{two look-alike domains registered in the same batch} were found, both hosted on the same Netherlands VPS.

\vspace{0.3em}
\begin{tcolorbox}[colback=lightgray,colframe=accent,arc=2pt,boxrule=1pt]
\textbf{Bottom line:} This is not a ``spoofed'' email --- it is a genuine, targeted phishing message sent through a legitimate authentication channel and vouched for by an \textbf{abused HPE mail-signing identity}. The receiving side (Gmail) had no way to block it. The true point of compromise lies in HPE's mail-sending credentials / DNS configuration and in the attacker's rented Netherlands server.
\end{tcolorbox}

%==================== EVIDENCE ====================
\section{Key Evidence Screenshots}

This section preserves the original screenshots of the phishing email in the victim's mailbox as first-hand evidence. The content is consistent with the technical analysis in \S5 and the raw headers in Appendix A.

\vspace{0.4em}
\textbf{Figure 1 --- Apparent sender.} Expanding the sender in the mail client shows \hl{\texttt{security@hpe.com}}. Note this is \textbf{not ordinary display-name spoofing}: as explained in \S5.1, the email actually carried a valid \texttt{hpe.com} DKIM signature and passed DMARC, so the client rendered it as a legitimate HPE sender.

\begin{figure}[H]
\centering
\fbox{\includegraphics[width=0.82\textwidth]{phishing-2026-08-26-evidence-1-sender-hpe.png}}
\caption*{\small\color{midgray} Figure 1: Expanded sender in the mail client; apparent sender is security@hpe.com.}
\end{figure}

\vspace{0.4em}
\textbf{Figure 2 --- Email body and disguised link.} The subject is \texttt{``Security Notice: Employee Account Re-registration Reminder,''} the recipient is the victim's Gmail (\texttt{fwx5618177@gmail.com}), and the client shows a send time of 09:22. The body, in the voice of the HPE IT security team, demands ``re-registration within 24 hours or access will be restricted.'' \hl{The link displayed in the body is \texttt{https://engine.okg.com/...} (disguised text), while the actual href points to the attacker domain \texttt{okg.enginelark.com}} (see \S5.2).

\begin{figure}[H]
\centering
\fbox{\includegraphics[width=0.92\textwidth]{phishing-2026-08-26-evidence-2-body-link.png}}
\caption*{\small\color{midgray} Figure 2: Full phishing email; the displayed link reads engine.okg.com but resolves to okg.enginelark.com.}
\end{figure}

%==================== 2. METADATA ====================
\section{Case Metadata}

\begin{longtable}{L{4.5cm} L{10.5cm}}
\toprule
\textbf{Field} & \textbf{Value} \\
\midrule
\endhead
Victim mailbox & \texttt{fwx5618177@gmail.com} (personal Gmail) \\
Apparent sender & \texttt{Security Team <security@hpe.com>} \\
Actual send path & Amazon SES (us-east-1), node \texttt{a8-53.smtp-out.amazonses.com} \\
Sending IP & \texttt{54.240.8.53} (Amazon Technologies Inc.) \\
Send time & 2026-08-25 18:22:14 PDT = \textbf{2026-08-26 01:22:14 UTC} \\
Phishing landing page & \url{https://okg.enginelark.com/welcome/new/employee/login} \\
Attacker server & \texttt{195.20.204.18} (Netherlands, Snel.com B.V.) \\
Real target & OK Group / OKX employee account system \\
Impersonated brands & HPE (email identity); OKX / OK Group (landing page) \\
Analysis date & 2026-08-27 \\
\bottomrule
\end{longtable}

%==================== 3. TIMELINE ====================
\section{Incident Timeline}

The table reconstructs the full sequence from infrastructure preparation to execution. Times are normalized to UTC where possible.

\begin{longtable}{L{3.2cm} L{11.8cm}}
\toprule
\textbf{Time (UTC)} & \textbf{Event} \\
\midrule
\endhead
1995-03-24 & \texttt{hpe.com} registered (MarkMonitor); legitimate HPE asset. \\
1998-09-22 & \texttt{okg.com} registered (now Amazon Registrar); legitimate OK Group asset, mail via Larksuite / Feishu. \\
2018-06-28 & \texttt{okpool.top} registered by OK Group (Alibaba Cloud HiChina); \textbf{legitimate own asset}, later used as an internal CNAME transit. \\
\midrule
\textbf{2026-08-05 09:03:22} & Attacker registers \hl{first look-alike \texttt{engine-okg.com}} (Namecheap, Iceland privacy proxy). \\
\textbf{2026-08-05 13:15:05} & Attacker registers \hl{second look-alike \texttt{enginelark.com}} (Namecheap, same privacy proxy, 4h12m later). \\
From 2026-08-05 & Attacker deploys the phishing kit on Netherlands VPS \texttt{195.20.204.18} (nginx/1.24.0, Ubuntu); obtains an SSL.com wildcard certificate \texttt{*.enginelark.com}. \\
\midrule
By 2026-08-25 & Attacker obtains the ability to send as \texttt{hpe.com} via Amazon SES (see \S5.1). \\
\textbf{2026-08-26 01:22:14} & \hl{Phishing email sent}, delivered to the victim's Gmail via SES (\texttt{54.240.8.53}); SPF/DKIM/DMARC all pass. \\
2026-08-26 (local) & Victim sees the email in the inbox (screenshot time 09:22). \\
\midrule
2026-08-27 & Analysis begins. Authoritative DNS confirms the relevant \texttt{hpe.com} DKIM selector now returns \hl{NXDOMAIN (revoked)}, indicating HPE / AWS-side remediation is underway. The landing page is still live. \\
\bottomrule
\end{longtable}

\textbf{Timing inference:} Both look-alike domains were registered on the same morning, roughly three weeks before the email was sent --- the classic ``build ahead, deploy on cue'' cadence of a phishing operation. The DKIM record disappeared within two days of the send, indicating HPE-side response has already started.

%==================== 4. KILL CHAIN ====================
\section{Attack Chain}

\begin{enumerate}[leftmargin=1.5em,label=\textbf{Step \arabic*.}]
\item \textbf{Delivery:} The email was sent via Amazon SES carrying a valid \texttt{d=hpe.com} DKIM signature, domain-aligned with \texttt{From: security@hpe.com}, so DMARC returned \texttt{pass}. Gmail delivered it to the inbox with no security warning.
\item \textbf{Pretext:} The Chinese-language body impersonates the HPE IT security team, creating urgency (``re-register within 24 hours or access will be restricted''); the genuine OKX CDN logo boosts credibility.
\item \textbf{Sleight-of-hand:} The anchor text shows \texttt{https://engine.okg.com/...}, while the actual \texttt{href} points to \texttt{https://okg.enginelark.com/welcome/new/employee/login}.
\item \textbf{Harvest:} The landing page (an Ant Design-styled ``Welcome to join OK Group'' login) requests a \textbf{corporate email + verification code}, posting them to the attacker's server via same-origin endpoints \texttt{POST /welcome/new/employee/send-code} and \texttt{POST /welcome/new/employee/verify}.
\item \textbf{Escape:} When the backend returns ``email already registered,'' the page shows a notice and, after 3 seconds, redirects the victim to the \textbf{real system} \texttt{https://enginelark.okg.com/engine/login}, so the victim assumes all is normal, does not become suspicious, and does not report --- extending the attack's lifespan.
\end{enumerate}

\begin{tcolorbox}[colback=lightgray,colframe=midgray,arc=2pt,boxrule=0.6pt]
\textbf{Uncertainty statement:} The page asks the victim for a ``verification code,'' meaning some system must send that code to the victim. The most plausible explanation is that the attacker's backend \textbf{makes a real-time request to OK Group's genuine system to trigger a legitimate code} (i.e.\ a one-time-password / OTP relay), enabling session hijacking and 2FA bypass. This report \textbf{did NOT verify} that behavior --- verifying it would require submitting test data to the attacker's endpoint, an unauthorized interaction with a third-party system that was deliberately avoided. This step should be confirmed by the OK Group security team in a controlled environment.
\end{tcolorbox}

%==================== 5. TECHNICAL ANALYSIS ====================
\section{Technical Analysis}

\subsection{How the Email Passed HPE Authentication (Key Finding)}

The authentication results from the victim's raw headers (verbatim excerpt):

\begin{Verbatim}[fontsize=\small,frame=single,breaklines=true,breakanywhere=true]
spf=pass    smtp.mailfrom=...@amazonses.com  (client-ip=54.240.8.53)
dkim=pass   header.i=@hpe.com  header.s=kgwu7d2xppvqvpl5d2eir2luwanbipyt
dkim=pass   header.i=@amazonses.com
dmarc=pass  (p=REJECT sp=REJECT dis=NONE)  header.from=hpe.com
\end{Verbatim}

\textbf{This is not forgery.} The DKIM signature is cryptographically valid: it verifies against the public key \texttt{hpe.com} published at the time, and the signing domain \texttt{d=hpe.com} is aligned with the header \texttt{From: hpe.com}, so DMARC passes even under \texttt{p=reject}. Forging DKIM requires the private key and is cryptographically infeasible; therefore the only possibility is that the attacker \textbf{legitimately obtained the ability to sign mail as \texttt{hpe.com}}.

\textbf{Key forensics:} The DKIM selector \texttt{kgwu7d2xppvqvpl5d2eir2luwanbipyt} is a 32-character lowercase random string --- \textbf{precisely the Amazon SES ``Easy DKIM'' token format}. SES can only sign with it if the domain owner has published the corresponding CNAME in DNS. Querying that selector against multiple public resolvers (8.8.8.8 / 1.1.1.1 / 9.9.9.9) and against \texttt{hpe.com}'s authoritative server \texttt{ns1.hpe.com} \textbf{all returned NXDOMAIN with the authoritative (aa) flag}; a random-label test confirmed \texttt{hpe.com} has \textbf{no wildcard}. Conclusion: the record \textbf{did exist at send time (2026-08-25) and has since been deleted}.

\textbf{Two possible paths (require AWS/HPE-side confirmation):}
\begin{itemize}[leftmargin=1.4em]
\item \textbf{Path A (more likely) --- SES credential compromise:} An AWS account belonging to HPE or one of its vendors had already completed SES domain verification for \texttt{hpe.com} (the DKIM CNAME was legitimately published). The attacker obtained that account's access keys (e.g.\ via a code-repo leak, CI logs, or a compromised vendor) and sent mail under the already-verified identity, so all checks passed. In this case \textbf{HPE's DNS was never tampered with}.
\item \textbf{Path B (less likely) --- DNS record injection:} The attacker, via compromised DNS-management privileges or an authorized third-party vendor, wrote their own SES account's DKIM CNAME into \texttt{hpe.com}.
\end{itemize}
Path A is favored because if the attacker truly controlled \texttt{hpe.com}'s DNS, its value (issuing TLS certificates, hijacking MX, taking over subdomains) would vastly exceed sending one phishing email; using it only to send mail fits ``holding only an SES sending permission.''

\subsection{Link and Visual Disguise}

The anchor in the email HTML (Base64-encoded body) is classic anchor-text deception:

\begin{Verbatim}[fontsize=\small,frame=single,breaklines=true,breakanywhere=true]
<a href="https://okg.enginelark.com/welcome/new/employee/login">
   https://engine.okg.com/welcome/new/employee/login</a>
<img src="https://static.coinall.ltd/cdn/assets/imgs/254/48452487343D915E.png" alt="OKX">
\end{Verbatim}

The displayed text is the brand domain \texttt{engine.okg.com}, but the actual jump is to the attacker domain \texttt{okg.enginelark.com} --- placing the brand word \texttt{okg} at the far left as a subdomain label, while the true registered domain is \texttt{enginelark.com} on the right. The logo hot-links OKX's genuine CDN \texttt{static.coinall.ltd}, leaving no visual tell.

\subsection{Attacker Infrastructure}

\begin{longtable}{L{4cm} L{11cm}}
\toprule
\textbf{Item} & \textbf{Value} \\
\midrule
\endhead
Look-alike domain 1 & \texttt{enginelark.com} (primary); subdomain \texttt{okg.enginelark.com} is the phishing landing page \\
Look-alike domain 2 & \texttt{engine-okg.com} (backup / earlier version; same IP, mismatched cert) \\
Registrar & Namecheap, Inc. \\
Registration date & Both 2026-08-05 (see timeline) \\
Registrant & Hidden (Withheld for Privacy ehf, Reykjavik, Iceland) \\
NS / MX & \texttt{*.registrar-servers.com} (Namecheap default DNS and mail forwarding) \\
Hosting IP & \texttt{195.20.204.18} \\
Reverse DNS & \texttt{s46983.hosted-by-snel.com} \\
Host & Snel.com B.V. / Ormilon B.V., AS62370 \\
Geolocation & Lelystad, Netherlands (company registered in Rotterdam, Schuttevaerweg 101) \\
Abuse contacts & \texttt{report@abuse.bz} (Snel); \texttt{abuse@namecheap.com} (Namecheap) \\
Web service & nginx/1.24.0 (Ubuntu), HTTP/2 \\
TLS certificate & Wildcard \texttt{*.enginelark.com}, issued by SSL.com TLS Issuing RSA CA R1, valid until 2027-02-19 \\
\bottomrule
\end{longtable}

\textbf{Evidence the two domains share an operator:} registered on the same day (2026-08-05), both via Namecheap, both using the same Iceland privacy proxy, both resolving to \texttt{195.20.204.18}, both serving the same phishing path \texttt{/welcome/new/employee/*}. \texttt{engine-okg.com}'s TLS cert is still \texttt{*.enginelark.com} (mismatched, browsers warn), suggesting a backup or earlier build, with \texttt{enginelark.com} chosen for production. Both domains' MX point to Namecheap mail forwarding, \textbf{meaning the attacker can receive mail at these domains}.

\subsection{Excluded False Positives}

\begin{itemize}[leftmargin=1.4em]
\item \texttt{okpool.top}, \texttt{enginelark.okg.com}, and \texttt{engine.okg.com} are \textbf{all legitimate OK Group assets}. \texttt{enginelark.okg.com} resolves via a CNAME chain \texttt{enginelarktransit.okpool.top} to OK Group's own AWS ELB --- a normal internal configuration. The phishing page references \texttt{enginelark.okg.com} only for the ``failure redirect'' (see \S4 Step 5); this does NOT imply those assets are compromised. \textbf{Do not add them to any block or abuse list.}
\end{itemize}

%==================== 6. ATTRIBUTION ====================
\section{Attribution: What Can and Cannot Be Determined}

\subsection{Determinable via Open Sources (OSINT)}
\begin{itemize}[leftmargin=1.4em]
\item Attacker infrastructure: two look-alike domains, hosting IP, host, certificate, send channel (Amazon SES us-east-1), and the unique SES message identifiers.
\item The targeted nature of the attack: precise knowledge of OK Group's internal system naming.
\item The fact that HPE's mail-signing identity was abused, and the time window in which that DKIM record was revoked.
\end{itemize}

\subsection{NOT Determinable Openly (Requires Institutional / Law-Enforcement Action)}
\begin{itemize}[leftmargin=1.4em]
\item \textbf{Attacker's real identity:} domain registrant is masked by an Iceland privacy proxy; VPS lessee details are held only by Snel. Open channels end here.
\item \textbf{The exact path of the HPE-identity abuse (A vs.\ B):} only AWS and HPE can distinguish this from internal logs.
\item \textbf{The OTP-relay hypothesis:} must be verified in a controlled environment; the attacker's endpoint should not be probed.
\end{itemize}

\subsection{The Most Valuable Attribution Lead: The Amazon SES Message Identifiers}
The \texttt{Message-ID} and \texttt{Feedback-ID} in the headers let AWS trace back to the \textbf{sending AWS account ID, registration email, payment method, and creation/login source IPs}. This is the only data in the entire case that \textbf{could point to a real identity}. Note, however, that this AWS account may itself be \textbf{a hijacked legitimate account} (e.g.\ an HPE vendor's) or \textbf{newly registered with a stolen credit card and false identity}; even after a lawful disclosure request, source-IP correlation and payment tracing may be needed to reach a real person.

%==================== 7. IOC ====================
\section{Indicators of Compromise (IOCs)}

\subsection{Indicators for Direct Blocking / Reporting}
\begin{Verbatim}[fontsize=\small,frame=single,breaklines=true,breakanywhere=true]
[Domains]
  okg.enginelark.com        (phishing landing page)
  enginelark.com            (attacker primary domain)
  engine-okg.com            (attacker backup / earlier version)
[IP]
  195.20.204.18             (AS62370 Snel.com B.V. / Lelystad, NL)
  54.240.8.53               (Amazon SES send node; do NOT block the whole range)
[URL paths]
  /welcome/new/employee/login
  /welcome/new/employee/send-code
  /welcome/new/employee/verify
[TLS certificate]
  CN=*.enginelark.com  (SSL.com TLS Issuing RSA CA R1, valid until 2027-02-19)
[Web fingerprint]
  Server: nginx/1.24.0 (Ubuntu)
\end{Verbatim}

\subsection{Email and Identity Identifiers (for AWS / HPE Disclosure)}
\begin{Verbatim}[fontsize=\small,frame=single,breaklines=true,breakanywhere=true]
SES Message-ID:
  010001a03ba91e87-f71f93ad-d4b6-4573-80e9-e8f961f4617b-000000
Feedback-ID:
  ::1.us-east-1.Mx7G8QgHyj7ECaoZ0+HgaLyxWu91cjlxcyOX7zhFyIw=:AmazonSES
X-SES-Outgoing:
  2026.08.26-54.240.8.53
Abused HPE DKIM selector (present at send time, now NXDOMAIN):
  kgwu7d2xppvqvpl5d2eir2luwanbipyt._domainkey.hpe.com
Apparent From:  Security Team <security@hpe.com>
Envelope From:  ...@amazonses.com (Return-Path)
\end{Verbatim}

\subsection{Exclusions (Legitimate Assets --- Do Not Report)}
\begin{Verbatim}[fontsize=\small,frame=single,breaklines=true,breakanywhere=true]
okpool.top / enginelark.okg.com / engine.okg.com   -- OK Group's own assets
static.coinall.ltd                                 -- OKX's real CDN (logo hot-linked)
\end{Verbatim}

%==================== 8. IMPACT & RESPONSE ====================
\section{Impact Assessment and Immediate Response}

\subsection{Impact}
\begin{itemize}[leftmargin=1.4em]
\item \textbf{Individual victim:} if email and verification code were entered on the landing page, the account should be treated as potentially compromised.
\item \textbf{OK Group:} highly targeted; other victims in the same batch are likely. If the OTP-relay hypothesis holds, the attack can bypass 2FA and directly threaten staff accounts and internal systems.
\item \textbf{HPE:} its mail-signing identity was abused by a third party to send phishing --- a security incident implying credential leakage or DNS-record injection.
\end{itemize}

\subsection{Victim Immediate Actions (if information was submitted)}
\begin{enumerate}[leftmargin=1.4em]
\item Immediately change the password on the \textbf{real system} \texttt{engine.okg.com}.
\item Revoke all active sessions; reset 2FA bindings.
\item Review login history for logins from the Netherlands / unusual IPs.
\item Click ``Report phishing'' on the email in Gmail.
\end{enumerate}

\subsection{Organizational and Reporting Actions (by priority)}
\begin{enumerate}[leftmargin=1.4em]
\item \textbf{Notify the OK Group security team (highest priority):} this is a targeted attack on the company; issue a company-wide alert, review \texttt{enginelark.okg.com} for anomalous logins, and confirm the OTP-relay hypothesis.
\item \textbf{Report to AWS:} \texttt{abuse@amazonaws.com} / AWS Trust \& Safety, attaching the SES identifiers in \S7.2, requesting suspension of the sending account and preservation of records.
\item \textbf{Report to HPE security:} \texttt{security-alert@hpe.com}, reporting abuse of \texttt{hpe.com} DKIM signing (include the selector).
\item \textbf{Report to SSL.com:} request revocation of the \texttt{*.enginelark.com} certificate; after revocation, browsers will block outright.
\item \textbf{Report to registrar / host for takedown:} Namecheap \texttt{abuse@namecheap.com}; Snel \texttt{report@abuse.bz}.
\item \textbf{Report to anti-phishing bodies:} Google Safe Browsing; APWG (\texttt{reportphishing@apwg.org}).
\end{enumerate}

%==================== 9. LAW ENFORCEMENT ====================
\section{Law-Enforcement and Accountability Path}

\textbf{Core principle:} the ceiling of individual and technical measures is ``takedown and suspension''; reaching a real identity and pursuing accountability \textbf{must go through institutional legal process}. Ordered by feasibility and effectiveness:

\begin{enumerate}[leftmargin=1.4em]
\item \textbf{File a police report (the critical step).} Only after a case is opened can law enforcement issue disclosure orders (subpoenas / mutual legal assistance requests) to \textbf{AWS, Namecheap, Snel} to obtain the real registrant, payment details and source IPs masked by ``privacy proxy'' and ``anonymous registration.'' All IOCs in this report are the evidence package prepared for this step.
\item \textbf{Have OK Group drive cross-border legal assistance.} As the targeted company, OK Group has both the motive and resources to file and pursue cross-border assistance. The hosting server is in the \textbf{Netherlands (EU)}, where MLAT / EU channels are mature. Snel and Namecheap must provide customer data upon receipt of lawful disclosure orders.
\item \textbf{Trace the sending account via AWS.} Using the SES identifiers, law enforcement can compel AWS to disclose the sending AWS account's registration, payment details and source IPs. Note this account may be hijacked or anonymously registered and may require further tracing.
\item \textbf{Evidence preservation and time-sensitivity.} Immediately timestamp-preserve the phishing page, certificate, DNS records and raw email headers (hash + trusted timestamp recommended), since the attacker may dismantle the infrastructure at any time, and some DNS records (e.g.\ the HPE DKIM) have already disappeared.
\end{enumerate}

\begin{tcolorbox}[colback=lightgray,colframe=accent,arc=2pt,boxrule=1pt]
\textbf{Explicit statement on ``hacking back'' the attacker's server:} This analysis did NOT, and should NOT, perform any port scanning, vulnerability probing, admin-panel brute forcing, or unauthorized access against the attacker's server. Reasons: (1) unauthorized access to third-party systems is \textbf{itself illegal} in most jurisdictions --- the target being a criminal is no exemption --- and it would taint the chain of evidence; (2) the VPS may be an \textbf{innocent third party's} machine compromised by the attacker, or a \textbf{honeypot}, so active interaction would tip off the adversary and invite retaliation; (3) the server is \textbf{disposable infrastructure} containing no real-identity information about the attacker --- identity leads sit in the host's and AWS's back-ends and can only be obtained through legal process. Accountability must proceed \textbf{entirely through law enforcement and professional DFIR / CERT channels}.
\end{tcolorbox}

%==================== APPENDIX ====================
\section*{Appendix A: Key Raw-Header Fields (Verbatim Excerpt)}
\addcontentsline{toc}{section}{Appendix A: Key Raw-Header Fields}

\begin{Verbatim}[fontsize=\footnotesize,frame=single,breaklines=true,breakanywhere=true]
Return-Path: <010001a03ba91e87-f71f93ad-d4b6-4573-80e9-e8f961f4617b-000000
             @amazonses.com>
Received: from a8-53.smtp-out.amazonses.com (54.240.8.53)
          by mx.google.com ... Tue, 25 Aug 2026 18:22:14 -0700 (PDT)
Authentication-Results: mx.google.com;
  dkim=pass header.i=@hpe.com header.s=kgwu7d2xppvqvpl5d2eir2luwanbipyt;
  dkim=pass header.i=@amazonses.com;
  spf=pass smtp.mailfrom=...@amazonses.com;
  dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=hpe.com
DKIM-Signature: v=1; a=rsa-sha256; d=hpe.com;
  s=kgwu7d2xppvqvpl5d2eir2luwanbipyt; ...
From: Security Team <security@hpe.com>
Subject: [Security Notice: Employee Account Re-registration Reminder]
Date: Wed, 26 Aug 2026 01:22:14 +0000
X-SES-Outgoing: 2026.08.26-54.240.8.53
\end{Verbatim}

\vspace{1em}
\begin{center}
\rule{0.5\textwidth}{0.4pt}\\[0.3em]
{\small\color{midgray} End of report --- This is a defensive security analysis intended solely for\\
lawful incident response, reporting and abuse notification. No unauthorized\\
access to any system was performed during the analysis.}
\end{center}

\end{document}
