Investigation Scenario 🔎
A user received this SMS: “UPS: Package Delivery Failed. Update your address.”
Browser history shows a visit to a fake UPS site, followed by a POST request to /api/verify.
What do you look for to investigate whether an incident occurred? (Your choice on phone OS)