How to investigate phishing campaigns

How to investigate phishing campaigns

HomeSANS Cyber DefenseHow to investigate phishing campaigns
How to investigate phishing campaigns
ChannelPublish DateThumbnail & View CountDownload Video
Channel AvatarPublish Date not found Thumbnail
0 Views
This is intended to be a comprehensive introduction to an OSINT-based methodology that the speaker uses to investigate phishing websites:

* Checking IP addresses – their basic details, reputation, associated services and domains, etc.
* Research of DNS records and DNS variations
* Examination of the technology stack – what makes up a particular website and what clues can be found in it
* SHA256 hash check on websites – when can it be useful, when not and why
* Checking Google tags and associated metadata (if available)
* Security certificates – what makes them useful for OSINT
* Navigate the source code of the website //"the F12 hacking/"
* Favicon search
* Other forms of interaction to collect live data (if applicable)

Read Maciej's blog post about a major phishing campaign using a kr3pto phishkit – https://www.osintme.com/index.php/2021/12/06/how-to-investigate-a-massive-phishing-campaign/

About the speaker
Maciej Makowski – Infosec and OSINT blogger. Former police officer. Graduate of University College Dublin and National College of Ireland. Author of osintme.com, a blog on OSINT and digital privacy.

Check out the upcoming summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#OSINTSummit #OSINT

Please take the opportunity to connect with your friends and family and share this video with them if you find it useful.