Protect against phishing attacks. Master practical OSINT investigation techniques and discover easy-to-use tools for uncovering phishing schemes.

You can also find this article on my Medium page.

Phishing attacks are an old threat, but they remain shockingly effective. With attackers becoming more sophisticated every year, knowing how to delve into a phishing campaign is a crucial skill for every OSINT analyst. This article will equip you with a well-rounded methodology to guide your investigations and help protect yourself and your organization.

Before we dive into analysis, let’s set the stage. Phishing is a form of social engineering. Attackers use mass emails or texts containing malicious links or attachments to trick victims into giving up sensitive information like login credentials. They prey on fear, urgency, or curiosity to make their targets act without thinking. These attacks can lead to data breaches, ransomware infections, and other serious cybersecurity incidents.

The numbers paint a grim picture. In 2023, 58% of organizations battled account takeovers, with a staggering 79% of those breaches originating from phishing. This highlights the risk for organizations of every size.

There are many effective ways to investigate phishing campaigns. Here’s a flexible, step-by-step approach to guide you:

• Perform a WHOIS Lookup: Begin by investigating the suspicious domain’s registration details. Though privacy rules may limit information, historical records often provide valuable clues.

• Assess Website Reputation: Verify the website’s reputation against threat intelligence databases and blacklists. This helps determine if it’s part of a known malicious campaign.

• Uncover Shared Hosting: Identify other websites hosted on the same IP address. This can expose larger attack patterns.

Note: Just 16 hours later, the site was yanked offline, nixing much of the detective work we were all set to dive into.

• Examine DNS Records: Look for suspicious DNS records that could point to the attacker’s infrastructure.

• Detect Typosquatting: Check for DNS variations of the domain (typosquatting), a common tactic to mimic legitimate websites.

• Expand Shortened Links: If the phishing message contains a shortened URL, try the following:

• Add “+” at the end of your browser.

• Utilize URL expansion services (like ExpandURL.net).

• Important Note: Be cautious, as these techniques might not work on all URL shortening services.

• Identify Associated Subdomains: Discover subdomains linked to the phishing domain. This can reveal the attacker’s attempts to target multiple brands with the same infrastructure.

• Determine Technologies Used: Uncover the technologies used to build the phishing site (use tools like “BuiltWith”).

• Analyze Security Certificate: Check the website’s security certificate. Phishers often abuse free services like Let’s Encrypt, which can be a red flag.

• Tracking Scripts and Ads: Scrutinize Google ads or tracking scripts and analyze their IDs for further clues.

• Check for Open Directories: Determine if the site is an open-directory website. These can expose sensitive files due to attacker negligence.

• Download Phishing Website: Download the entire phishing website (e.g., using HTTrack) for in-depth analysis.

• Scrutinize HTML Code: Carefully examine the website’s HTML code for:

• Copied elements from legitimate websites

• Links to external malicious sources

• Image and File Metadata: Analyze image and file metadata, but remember, modern attackers may remove this information.

• Calculate HTML Hash Value: Calculate the phishing page’s HTML hash value.

• Search for Matches: Use various hash algorithms to search for the same hash value on platforms like URLScan. This helps uncover networks of connected phishing sites.

• Investigate Favicon Hash: Do the same for the favicon’s hash to identify sites potentially impersonate legitimate ones.

8. Live Interaction for Dynamic Analysis (When Safe)

• Use Developer Tools: When safe, interact with the phishing website using developer tools to monitor its behavior.

• Test with Fake Logins: Attempt fake logins or interactions to observe redirects or uncover hidden attacker communication methods.

The phishing landscape is constantly changing. Keep an eye on these emerging trends:

1. Sophisticated Impersonation Attacks: Phishing campaigns have become more sophisticated, using impersonation of IT and HR systems to trick employees into engaging with malicious links that lead to fraudulent sites almost identical to real ones​​.

2. Payloadless Malware: This type of attack does not rely on traditional malicious files. Instead, attackers trick victims into calling a fraudulent call center, where they are persuaded to download malware under the guise of reversing a transaction​.

3. QR Code Phishing (Quishing): The use of QR codes in phishing, known as “quishing,” is on the rise. These attacks are challenging to detect because they rely heavily on images rather than text, bypassing many traditional security measures​.

4. Vendor Email Compromise (VEC): These attacks compromise email accounts of vendors or other third parties that have established relationships with the target. Attackers then use these accounts to conduct financial fraud or obtain sensitive information​.

5. AI-Generated Attacks: AI technologies enable cybercriminals to generate sophisticated and unique phishing content, raising the complexity and effectiveness of attacks​​.

Let me share some widely used OSINT tools ideal for conducting phishing investigations. These tools are designed to be accessible and user-friendly for all levels of technical expertise.

• Urlscan.io is a web-based tool designed to help users analyze and investigate URLs. It provides a sandbox environment for the web with different visibility levels for scans. It allows for comprehensive scanning of websites from various countries and with different user agents, aiding in cybersecurity efforts by examining the content and behavior of websites.

• ExpandURL.net is a service designed to reveal the destination of shortened URLs before you click on them. It enhances online safety by helping users avoid potential phishing, malware, and viruses. It provides users with the final link destination and additional information about the URL, aiding in deciding whether to visit the link.

• Pentest-Tools.com offers a Subdomain Finder tool that leverages both passive and active discovery methods to help cybersecurity professionals identify the subdomains of a target domain, enhancing their reconnaissance efforts. The tool validates scan results to ensure relevance and provides comprehensive recon data, including IP addresses, WHOIS details, and server technologies. It is an essential tool for mapping an organization’s attack surface and uncovering potential vulnerabilities.

• SEOSiteCheckup.com is a tool designed to check whether a website’s directories are publicly visible and browsable. This is a potential security risk that could expose sensitive files to unauthorized users.

• Chrome DevTools, integrated into the Google Chrome browser, offers a suite of web development tools allowing for the real-time editing of web pages and diagnostics of issues to improve website construction and debugging speed. It covers various functions, from DOM manipulation to performance analysis, designed to streamline the development process and enhance website performance and accessibility.

Stop sabotaging your OSINT investigations before they even start. Read this article next…

https://publication.osintambition.org/biggest-osint-investigation-mistake-youre-making-and-how-to-fix-it-9d0bed8c1058

It takes less than 16 seconds to summarize, format, and tag your collected intel with a custom Intel Sourcing Agent. Dive into the how-to guide and start organizing your findings like a pro! Read on…

https://publication.osintambition.org/chatgpt-for-osint-analysts-your-ai-powered-assistant-for-organizing-collected-intelligence-33bbe4b1fac5

For more blockchain, cybersecurity, and cybercrime research, visit Blockchain Insights Hub.

Follow me on Twitter to receive the latest articles and updates directly in your feed. Alternatively, you can subscribe to receive email alerts whenever I publish new content.