--- title: "Quickbooks Phishing Email Live Walkthrough | DuoCircle" description: "Hilton and I were talking and he mentioned to me that he got a great looking phishing email in his Yahoo account." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/" --- Quick Answer A walkthrough of a Yahoo Mail phishing email impersonating Intuit/QuickBooks. The post inspects the message format, headers, and the WHOIS for the lookalike domain (intuitpaymentint.com), then compares the cloned landing page against the real Intuit site and shows how the attackers used a compromised WordPress site to host the fake page. A second, less-sophisticated phishing message arrives during the review and gets the same header and link analysis. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fquickbooks-phishing-email-live-walkthrough%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Quickbooks%20Phishing%20Email%20Live%20Walkthrough&url=undefined%2Fblog%2Fphishing-protection%2Fquickbooks-phishing-email-live-walkthrough%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fquickbooks-phishing-email-live-walkthrough%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fquickbooks-phishing-email-live-walkthrough%2F&title=Quickbooks%20Phishing%20Email%20Live%20Walkthrough "Share on Reddit") [ ](mailto:?subject=Quickbooks%20Phishing%20Email%20Live%20Walkthrough&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fquickbooks-phishing-email-live-walkthrough%2F "Share via Email") ![Phishing Email](https://media.mailhop.org/duocircle/images/2016/10/hosted-email-server-3247.jpg) Hilton and I were talking and he mentioned to me that he got a **great looking phishing email in his Yahoo account**, so I decided to take a quick look at the format and believability of the message to see if it would fool the average user. I was VERY surprised at how well this message was formatted and you’ll see that during my review a second less. **I was VERY surprised at how well this message was formatted and as an extra bonus you’ll see that during my review a second less sophisticated message comes in and I go through a similar process of reviewing headers and reviewing the website.** This is a real-time video of me going through the messages. For some reason the audio is a little screwed up, I don’t think my voice sounds so squeaky, but hey, who knows perhaps I really do sound like that… ### **Initial Phishing Message** ![phishing-message1](https://media.mailhop.org/duocircle/images/2016/10/phishing-message1-1024x495.png) ### **Which Page is the Real Intuit Website?** [![fake_page](https://media.mailhop.org/duocircle/images/2016/10/fake_page-1024x437.jpg)](https://media.mailhop.org/duocircle/images/2016/10/fake%5Fpage.jpg) You can click on the image to see the full resolution. ### **Registering a Domain Name with the Intuit Brand** ![whois_intuitpaymentint_com](https://media.mailhop.org/duocircle/images/2016/10/Whois_intuitpaymentint_com.png) ### **WordPress Exploited Site** ![hi1ton_-_yahoo_mail](https://media.mailhop.org/duocircle/images/2016/10/hi1ton_-_Yahoo_Mail-1024x270.png) --- ### **Second Phishing Email that comes in while I am Reviewing the First Message** ![second-phishing-message](https://media.mailhop.org/duocircle/images/2016/10/second-phishing-message.png) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Quickbooks Phishing Email Live Walkthrough","description":"Hilton and I were talking and he mentioned to me that he got a great looking phishing email in his Yahoo account.","url":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/","datePublished":"2016-10-28T05:01:17.000Z","dateModified":"2025-05-22T14:10:06.000Z","dateCreated":"2016-10-28T05:01:17.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/"},"articleSection":"phishing-protection","keywords":"","wordCount":197,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2016/10/hosted-email-server-3247.jpg","caption":"Phishing Email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Quickbooks Phishing Email Live Walkthrough","item":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Quickbooks Phishing Email Live Walkthrough","item":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Quickbooks Phishing Email Live Walkthrough","description":"Hilton and I were talking and he mentioned to me that he got a great looking phishing email in his Yahoo account.","url":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/","datePublished":"2016-10-28T05:01:17.000Z","dateModified":"2025-05-22T14:10:06.000Z","dateCreated":"2016-10-28T05:01:17.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/quickbooks-phishing-email-live-walkthrough/"},"articleSection":"phishing-protection","keywords":"","wordCount":197,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2016/10/hosted-email-server-3247.jpg","caption":"Phishing Email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```