Tag phishing attack investigation