Cipher Day 01 · CTI + OSINT · Case 001

The Quiet Relay

A suspicious invoice is more than a bad email. Trace its infrastructure, corroborate the clues, and identify the campaign behind the relay in CipherPoint's first limited-time case study.

Incident brief

Training case

Northstar Payments reported a billing email that failed authentication checks. The sender name looks familiar, but the message carries an unexpected relay and a suspicious invoice link.

Connect email artifacts, synthetic network telemetry, and offline OSINT snapshots. Treat each item as evidence; this fictional exercise makes no real-world attribution.

InvestigationTrace the lure to its campaign cluster

LabOne isolated Alpine Linux desktop

Reward500 CipherPoints

Open machine details Preparing event…

Your investigation workspace

A Linux machine, ready for the case

Launch a disposable Alpine desktop in your browser. The evidence files are preloaded, so you can focus on the investigation rather than installing tools or configuring a network.

Alpine Linux Openbox desktop Offline evidence pack Resettable session

View machine & launch lab