# data[].attributes.body
I have 2 dogs, 1 cat and 3 birds called Karen

⬇️
Ih2d,1c&3bcK

# data[].attributes.attachment_link.readable_text
Pastes you were found in

A paste is information that has been published to a publicly facing website designed to share content and is often an early indicator of a data breach. Pastes are automatically imported and often removed shortly after having been posted. Using the 1Password password manager helps you ensure all your passwords are strong and unique such that a breach of one service doesn't put your other services at risk.

# data[].attributes.attachment_link.title
Have I Been Pwned: Check if your email has been compromised in a data breach

# data[].attributes.attachment_link.description
Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

# data[].attributes.body
I wish I had 3 cats and 1 dog！

⬇️

IwIh3c&1d!

# data[].attributes.headline
1. 每四個月換一次密碼

# data[].attributes.body
1. 每四個月換一次密碼

2. 確保你的密碼很獨特

3.包括大小寫、數字、特殊符號

4. 字典沒有的字

5.密碼長度超過16字母/字元最為理想

# data[].attributes.body
建議：用一組passphrase當作主密碼，進入密碼管理員帳號

密碼管理服務：

●Google Password Manager

●Bitwarden

●1Password

Password Safe

# data[].attributes.body
● password manager 不只幫你記住密碼，也可以幫你生成保護力強，防駭客的密碼

●使用可靠的password manager服務：密碼會加密；提供兩段密碼確認步驟

●Google Chrome 瀏覽器會自動加密，用戶進入帳戶必須登入，然後確認身分，例如用密碼進入桌機，或解鎖進入手機。.

# data[].attributes.headline
Chrome 如何儲存您的密碼取決於您是

# data[].attributes.body
Chrome 如何儲存您的密碼取決於您是否希望在多個設備上儲存和使用它們。當同步開啟時，密碼可以在您所有設備上的 Chrome 上使用，並在部分 Android 設備上的應用程式中使用。
○ 當 Chrome 中的密碼同步開啟時，您的密碼將儲存在您的 Google 帳戶中。
○ 否則，您的密碼僅儲存在您電腦上的 Chrome 中。

# data[].attributes.wish_content.attachment_props.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine

# data[].attributes.wish_content.attachment_props.original_text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.embed_code
Unbelievable

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine pic.twitter.com/pbOYjBquP2
— Iman Jalali (@Stealx) July 11, 2023

# data[].attributes.attachment_link.metadata.attachment_props_source.data.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.metadata.attachment_props.original_text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.metadata.attachment_props.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine

# data[].attributes.attachment_link.readable_text
網路肉搜已經成為當前網路盛行的手法之一，只要有心人士透過Google搜尋個人資料，就能從搜尋結果查出對方所有個人資訊。

要是不希望Google搜尋引擎結果不要出現自己的個資，想要求Google從搜尋結果刪除個人資料，比如真實姓名、學校、電話號碼、私人照片或身分證等私密個資，都可以透過這篇利用四種步驟線上提出移除Google搜尋結果，就能避免個人資料外洩。

如何提出Google刪除個資教學

步驟ㄧ：向Google提出移除個人資料

要是發現Google搜尋結果內有出現個人資料，可以先透過「 Google移除特定資訊網頁 」內，選擇要移除的資料類型。

目前Google允許用戶可以自行提出要刪除搜尋結果的個資，包含底下幾種個人識別資料出現在Google搜尋結果，就可以透過線上提出移除申請。

在選擇「 移除個人識別資訊 (PII) 或人肉搜尋內容」後，就可以透過開始提出「 要求Google刪除個資 」申請。

步驟二：選擇Google搜尋移除個資類別

從移除個人內容的頁面選項中，直接點選「 內容包含個人資料 」，並且選擇居住國家/地區，按「下一個」按鈕繼續。

步驟三：選取要求從 Google 搜尋移除內容

再來要選擇要從Google搜尋結果內移除哪種個人資訊，可以選擇身分證、地址、電話號碼、電子郵件等個資資料，或是銀行帳號和信用卡號照片資料同樣都能要求刪除，在選擇後會跳出是否出於惡意或人肉搜索威脅的內容？可依照自己認知與嚴重度選擇。

步驟四：填寫移除個人資訊搜尋內容

接下來會要求填寫當事人真實全名，是否為本人、電子郵件和居住國家地區資料。

在內容資訊部分，要將外洩的網頁或圖片/影片網址直接貼上，並且將Google搜尋結果網址也要一併附上。

最後可以將畫面擷取下來上傳，最後勾選法律義務選項，就能按下「提交」送出。

步驟五：申請成功等待審核結果

最後會看見移除Google搜尋結果畫面，接下來就會交由Google審查小組進行審核，並且會評估內容是否受影響，要是成功刪除資料，系統也會透過申請表所留的電子郵件告知結果。

如果要求不符合規定，同樣會透過電子郵件說明遭拒絕原因，也可以重新再次提出刪除要求，或是補足其他佐證資料。

功能總結

要是在Google搜尋結果或頁面索引上發現自己的個資，可以透過線上申請提出刪除要求，通常透過這方法也並非即時，要等數小時或數個工作天以上才會被移除。

不過要注意Google認定的個人資料是指姓名、出生年月日、國民身分證統一編號、護照號碼、電話號碼病歷、信用卡與銀行提款卡資料，其餘家庭、婚姻、教育、職業就不算在個資範圍內，只有真實姓名和其他資料出現在 Google 搜尋結果內，才可以向 Google 提出申訴直接要求移除搜尋結果內容。
更多實用技巧推薦：

# data[].attributes.attachment_link.title
如何讓Google搜尋不到自己的名字？提出Google刪除個資教學

# data[].attributes.attachment_link.description
網路肉搜已經成為當前網路盛行的手法之一，只要有心人士透過Google搜尋個人資料，就能從搜尋結果查出對方所有個人資訊。

# data[].attributes.headline
難以置信一名俄羅斯潛艇指

# data[].attributes.body
難以置信

一名俄羅斯潛艇指揮官昨天在跑步時遭暗殺

他在 Strava 上發布了他的運動狀況！

點讚的其中一人是烏克蘭情報局局長

# data[].attributes.wish_content.attachment_props.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine

# data[].attributes.wish_content.attachment_props.original_text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.embed_code
Unbelievable

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine pic.twitter.com/pbOYjBquP2
— Iman Jalali (@Stealx) July 11, 2023

# data[].attributes.attachment_link.metadata.attachment_props_source.data.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.metadata.attachment_props.original_text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine https://t.co/pbOYjBquP2

# data[].attributes.attachment_link.metadata.attachment_props.text
Unbelievable 

A Russian submarine commander was assassinated on his run yesterday

He was posting his workouts on Strava!

One of the people who liked the posts, was the Chief of Intelligence of Ukraine

# data[].attributes.attachment_link.readable_text
Phishing is one of the most common methods of cyber crime, but despite how much we think we know about scam emails, people still frequently fall victim.

Action Fraud receives more than 400,000 reports of phishing emails each year, and according to the Mimecast's State of Email Security 2020, 58% of organisations saw phishing attacks increase in the past 12 months.

Meanwhile, Verizon's latest Data Breach Investigations Report found that more than two thirds of data breaches involved social engineering attacks such as phishing.

In this blog, we use real phishing email examples to demonstrate five clues to help you spot scams.

1. The message is sent from a public email domain

No legitimate organisation will send emails from an address that ends '@gmail.com'.

Not even Google.

Most organisations, except some small operations, will have their own email domain and company accounts. For example, legitimate emails from Google will read '@google.com'.

If the domain name (the bit after the @ symbol) matches the apparent sender of the email, the message is probably legitimate.

The best way to check an organisation's domain name is to type the company's name into a search engine.

This makes detecting phishing seem easy, but cyber criminals have plenty of tricks up their sleeves to deceive you.
Top tip: Look at the email address, not just the sender
Many of us don't ever look at the email address that a message has come from.

Your inbox displays a name, like 'IT Governance', and the subject line. When you open the email, you already know (or think you know) who the message is from and jump straight into the content.

When crooks create their bogus email addresses, they often have the choice to select the display name, which doesn't have to relate to the email address at all.

They can, therefore, use a bogus email address that will turn up in your inbox with the display name Google.

But criminals rarely depend on their victim's ignorance alone. Their bogus email addresses will use the spoofed organisation's name in the local part of the address.

Take this example of a phishing email mimicking PayPal:

This is a nearly flawless scam email. It uses PayPal's logo at the top of the message, it is styled professionally and the request is believable.

But as much as it attempts to replicate a genuine email from PayPal, there's one huge red flag: the sender's address is 'paypal@notice-access-273.com'.

A genuine email from PayPal would have the organisation's name in the domain name, indicating that it had come from someone at (@) PayPal. That PayPal isn't in the domain name is proof that this is a scam.

Unfortunately, simply including PayPal anywhere in the message is often enough to trick people.

They might glance at the word PayPal in the email address and be satisfied, or simply not understand the difference between the domain name and the local part of an email address.

2. The domain name is misspelt

There's another clue hidden in domain names that provide a strong indication of phishing scams - and it unfortunately complicates our previous clue.

The problem is that anyone can buy a domain name from a registrar. And although every domain name must be unique, there are plenty of ways to create addresses that are indistinguishable from the one that's being spoofed.

The Gimlet Media podcast 'Reply All' demonstrated how difficult it can be to spot a spoofed domain in the episode What Kind Of Idiot Gets Phished?. Phia Bennin, the show's producer, hired an ethical hacker to phish various employees.

The hacker bought the domain 'gimletrnedia.com' (that's r-n-e-d-i-a, rather than m-e-d-i-a) and impersonated Bennin.

His scam was so successful that he tricked the show's hosts, Gimlet Media's CEO and its president.
You don't need to fall victim to help criminal hackers
As Bennin went on to explain, you don't even need to fall victim for a criminal hacker to gain vital information.

In this scam, the ethical hacker, Daniel Boteanu, could see when the link was clicked, and in one example that it had been opened multiple times on different devices.

He reasoned that the target's curiosity kept bringing him back to the link but that he was suspicious enough not to follow its instructions.

Boteanu explains:

I'm guessing [the target] saw that something was going on and he started digging a bit deeper and [...] trying to find out what happened [...]And I'm suspecting that after, [the target] maybe sent an email internally saying, "Hey guys! This is what I got. Just be careful. Don't click on this [...] email.

Boteanu's theory is exactly what had happened. But why does that help the hacker? Bennin elaborates:

The reason Daniel had thought [the target] had done that is because he had sent the same email to a bunch of members of the team, and after [the target] looked at it for the fourth time, nobody else clicked on it. And that's okay for Daniel because he can try, like, all different methods of phishing the team, and he can try it a bunch of different times. [And] since [the target is] sounding alarm bells, he probably won't include [him] in the next phishing attempt.

Therefore, in many ways, criminal hackers often still win even when you've thwarted their initial attempt.

That is to say, indecisiveness in spotting a phishing scam provides clues to the scammer about where the strengths and weaknesses in your organisation are.

It takes very little effort for them to launch subsequent scams that make use of this information, and they can keep doing this until they find someone who falls victim.

Remember, criminal hackers only require one mistake from one employee for their operation to be a success. As such, everyone in your organisations must be confident in their ability to spot a scam upon first seeing it.

3. The email is poorly written

You can often tell if an email is a scam if it contains poor spelling and grammar.

Many people will tell you that such errors are part of a 'filtering system' in which cyber criminals target only the most gullible people.

The theory is that, if someone ignores clues about the way the message is written, they're less likely to pick up clues during the scammer's endgame.

However, this only applies to outlandish schemes like the oft-mocked Nigerian prince scam, which you have to be incredibly naive to fall victim to.

That, and scams like it, are manually operated: once someone takes to the bait, the scammer has to reply. As such, it benefits the crooks to make sure the pool of respondents contains only those who might believe the rest of the con.

But this doesn't apply to phishing.

Automated attacks

With phishing, scammers don't need to monitor inboxes and send tailored responses. They simply dump thousands of crafted messages on unsuspecting people.

As such, there's no need to filter out potential respondents. Doing so reduces the pool of potential victims and helps those who didn't fall victim to alert others to the scam, like we saw in the earlier example with Gimlet Media.

So why are so many phishing emails poorly written? The most obvious answer is that the scammers aren't very good at writing.

Remember, many of them are from non-English-speaking countries and from backgrounds where they will have limited access or opportunity to learn the language.

With this in mind, it becomes a lot easier to spot the difference between a typo made by a legitimate sender and a scam.
Top tip: Look for grammatical mistakes, not spelling mistakes
When crafting phishing messages, scammers will often use a spellchecker or translation machine, which will give them all the right words but not necessarily in the proper context.

Take this example of a scam imitating Windows:

No individual word is spelled incorrectly, but the message is full of grammatical errors that a native speaker wouldn't make, such as "We detected something unusual to use an application".

Likewise, there are strings of missed words, such as in "a malicious user might trying to access" and "Please contact Security Communication Center".

These are consistent with the kinds of mistakes people make when learning English. Any supposedly official message that's written this way is almost certainly a scam.

That's not to say any email with a mistake in it is a scam, however. Everyone makes typos from time to time, especially when they're in a hurry.

It's therefore the recipient's responsibility to look at the context of the error and determine whether it's a clue to something more sinister. You can do this by asking:

Is it a common sign of a typo (like hitting an adjacent key)?

Is it a mistake a native speaker shouldn't make (grammatical incoherence, words used in the wrong context)?

Is this email a template, which should have been crafted and copy-edited?

Is it consistent with previous messages I've received from this person?

If you're in any doubt, look for other clues that we've listed here or contact the sender using another line of communication, whether that's in person, by phone, via their website, an alternative email address or through an instant message client.

4. It includes suspicious attachments or links

Phishing emails come in many forms. We've focused on emails in this article, but you might also get scam text messages, phone calls or social media posts.

But no matter how phishing emails are delivered, they all contain a payload. This will either be an infected attachment that you're asked to download or a link to a bogus website.

The purpose of these payloads is to capture sensitive information, such as login credentials, credit card details, phone numbers and account numbers.

What is an infected attachment?

An infected attachment is a seemingly benign document that contains malware. In a typical example, like the one below, the phisher claims to be sending an invoice:

It doesn't matter whether the recipient expects to receive an invoice from this person or not, because in most cases they won't be sure what the message pertains to until they open the attachment.

When they open the attachment, they'll see that the invoice isn't intended for them, but it will be too late. The document unleashes malware on the victim's computer, which could perform any number of nefarious activities.

We advise that you never open an attachment unless you are fully confident that the message is from a legitimate party. Even then, you should look out for anything suspicious in the attachment.

For example, if you receive a pop-up warning about the file's legitimacy or the application asks you to adjust your settings, then don't proceed.

Contact the sender through an alternative means of communication and ask them to verify that it's legitimate.

Suspicious links

You can spot a suspicious link if the destination address doesn't match the context of the rest of the email.

For example, if you receive an email from Netflix, you would expect the link to direct you towards an address that begins 'netflix.com'.

Unfortunately, many legitimate and scam emails hide the destination address in a button, so it's not immediately apparent where the link goes to.

In this example, you would probably know that something was suspicious if you saw the destination address in the email.

Unfortunately, the rest of the message is pretty convincing, and you might click the link without giving it a second thought.

To ensure you don't fall for schemes like this, you must train yourself to check where links go before opening them.

Thankfully, this is straightforward: on a computer, hover your mouse over the link, and the destination address appears in a small bar along the bottom of the browser.

On a mobile device, hold down on the link and a pop-up will appear containing the link.

5. The message creates a sense of urgency

Scammers know that most of us procrastinate. We receive an email giving us important news, and we decide we'll deal with it later.

But the longer you think about something, the more likely you are to notice things that don't seem right.

Maybe you realise that the organisation doesn't contact you by that email address, or you speak to a colleague and learn that they didn't send you a document.

Even if you don't get that 'a-ha' moment, coming back to the message with a fresh set of eyes might help reveal its true nature.

That's why so many scams request that you act now or else it will be too late. This has been evident in every example we've used so far.

PayPal, Windows and Netflix all provide services that are regularly used, and any problems with those accounts could cause immediate inconveniences.
The business depends on you
The manufactured sense of urgency is equally effective in workplace scams.

Criminals know that we're likely to drop everything if our boss emails us with a vital request, especially when other senior colleagues are supposedly waiting on us.

A typical example looks like this:

Phishing scams like this are particularly dangerous because, even if the recipient did suspect foul play, they might be too afraid to confront their boss.

After all, if they are wrong, they're essentially implying that there was something unprofessional about the boss's request.

However, organisations that value cyber security would accept that it's better to be safe than sorry and perhaps even congratulate the employee for their caution.

Prevent phishing by educating your employees

The advice in this blog shows how important it is for individuals to recognise signs of phishing.

One of the most effective ways of doing that is to give staff regular reminders of what they should look out for. This doesn't just mean staff awareness training - which, although essential, can only be carried out so often.

You can instead make sure employees are always alert by hanging a few well-placed posters in the office.

Our Phishing Awareness Posters contain a set of 5 posters that will catch employees' eyes and make sure they stay alert and informed about the threat of phishing attacks.
A version of this blog was originally published on 16 March 2018.

# data[].attributes.attachment_link.title
5 Ways to Detect a Phishing Email: With Examples

# data[].attributes.attachment_link.description
Phishing is one of the most common methods of cyber crime, but despite how much we think we know about scam emails, people still frequently fall victim. Action Fraud receives more than 400,000 reports of phishing emails each year, and according to the Mimecast's State of Email Security 2020, 58% of organisations saw phishing attacks increase in the past 12 months.

# data[].attributes.attachment_link.readable_text
Have you ever heard the computer security advice, "Don't open attachments"? This is solid advice, but unfortunately for journalists, activists, and many other people, it's impossible to follow. Imagine if you were a journalist and got an email from someone claiming to work for the Trump Organization with "Donald Trump tax returns.pdf" attached. Are you really going to reply saying, "Sorry, I don't open attachments" and leave it at that?

The truth is, as a journalist, it's your job to open documents from strangers, whether you get them in an email, a Signal or WhatsApp message, or through SecureDrop. Journalists also must open and read documents downloaded from all manner of websites, from leaked or hacked email dumps, or from any number of other potentially untrustworthy sources.

Dangerzone aims to solve this problem. You can install Dangerzone on your Mac, Windows, or Linux computer, and then use it to open a variety of types of documents: PDFs, Microsoft Office or LibreOffice documents, or images. Even if the original document is dangerous and would normally hack your computer, Dangerzone will convert it into a safe PDF that you can open and read.

You can think of it like printing a document and then rescanning it to remove anything sketchy, except all done in software.

Download Dangerzone for Windows, macOS or Linux to get started.

How can a document be dangerous?

PDFs and office documents are incredibly complex. They can be made to automatically load an image from a remote server when the document is open, tracking when a document is opened and from what IP address. They can contain JavaScript or macros that, depending on how your software is configured, could automatically execute code when opened, potentially taking over your computer. And finally, like all software, the programs you use to open documents - Preview, Adobe Reader, Microsoft Word, LibreOffice, etc. - have bugs, and these bugs can sometimes be exploited to take over your computer. (You can reduce your risk of getting hacked by always installing your updates, which fix the bugs that software vendors are aware of.)

For example, if an attacker knows about a security bug in Microsoft Word, they can carefully craft a Word document that, when opened using a vulnerable version of Word, will hack your computer. All they have to do is trick you into opening it, perhaps by sending you a convincing enough phishing email.

This is exactly what Russian military intelligence did during the 2016 US election. First, they hacked a US election vendor known as VR Systems and got their client list. Then they send 122 emails to VR Systems' clients (election workers in swing states) from the email address [email protected], with the attachment "New EViD User Guides.docm".
Screenshot of spearphishing email provided to The Intercept from a North Carolina public records request
If any of the election workers who got this email opened the attachment using a vulnerable version of Word in Windows, the malware would have created a backdoor into their computer for the Russian hackers. (We don't know if anyone opened the document or not, but they might have.)

If you got this email today and opened New EViD User Guides.docm using Dangerzone, it will convert it into a safe PDF (New EViD User Guides-safe.pdf), and you can safely open this document in a PDF viewer, without risking getting hacked.

Inspired by Qubes TrustedPDF

I got the idea for Dangerzone from Qubes, an operating system that runs everything in virtual machines. In Qubes, you can right-click on a PDF and choose "Convert to TrustedPDF". I gave a talk called Qubes OS: The Operating System That Can Protect You Even If You Get Hacked in 2018 at the Circle of HOPE hacker conference in New York. I talk about how TrustedPDF works for about 2 minutes starting at 9:20:

Dangerzone was inspired by TrustedPDF but it works in non-Qubes operating systems, which is important, because most of the journalists I know use Macs and probably won't be jumping to Qubes for some time.

It uses Linux containers to sandbox dangerous documents instead of virtual machines. And it also adds some features that TrustedPDF doesn't have: it works with any office documents, not just PDFs; it uses optical character recognition (OCR) to make the safe PDF have a searchable text layer; and it compresses the final safe PDF.

How does Dangerzone work?

Dangerzone uses Linux containers (two of them), which are sort of like quick, lightweight virtual machines that share the Linux kernel with their host. The easiest way to get containers running on Mac and Windows is by using Docker Desktop. So when you first install Dangerzone, if you don't already have Docker Desktop installed, it helps you download and install it.

When Dangerzone starts containers, it disables networking, and the only file it mounts is the suspicious document itself. So if a malicious document hacks the container, it doesn't have access to your data and it can't use the internet, so there's not much it could do.

Here's how it works. The first container:

Mounts a volume with the original document

Uses LibreOffice or GraphicsMagick to convert original document to a PDF

Uses poppler to split PDF into individual pages, and to convert those to PNGs

Uses GraphicsMagick to convert PNG pages to RGB pixel data

Stores RGB pixel data in separate volume

Then that container quits. A second container starts and:

Mounts a volume with the RGB pixel data

If OCR is enabled, uses GraphicsMagick to convert RGB pixel data into PNGs, and Tesseract to convert PNGs into searchable PDFs

Otherwise uses GraphicsMagick to convert RGB pixel data into flat PDFs

Uses poppler to merge PDF pages into a single multipage PDF

Uses ghostscript to compress final save PDF

Stores safe PDF in separate volume

Then that container quits, and the user can open the newly created safe PDF.

Here are types of documents that Dangerzone can convert into safe PDFs:

PDF (.pdf)

Microsoft Word (.docx, .doc)

Microsoft Excel (.xlsx, .xls)

Microsoft PowerPoint (.pptx, .ppt)

ODF Text (.odt)

ODF Spreadsheet (.ods)

ODF Presentation (.odp)

ODF Graphics (.odg)

EPUB (.epub)

Jpeg (.jpg, .jpeg)

GIF (.gif)

PNG (.png)

SVG (.svg)

TIFF (.tif, .tiff)

Other image formats (.bmp, .pnm, .pbm, ppm)

It's still possible to get hacked with Dangerzone

Like all software, it's possible that Dangerzone (and more importantly, the software that it relies on like LibreOffice and Docker) has security bugs. Malicious documents are designed to target a specific piece of software - for example, Adobe Reader on Mac. It's possible that someone could craft a malicious document that specifically targets Dangerzone itself. An attacker would need to chain these exploits together to succeed at hacking Dangerzone:

An exploit for either LibreOffice or GraphicsMagic

A container escape exploit in the Linux kernel

In Mac and Windows, a VM escape exploit for Docker Desktop

If you opened such a malicious document with Dangerzone, it would start the first container and begin the conversion process. While it was converting the original document (say, a docx file) into a PDF using LibreOffice, it would exploit a vulnerability in LibreOffice to hack the container. Then, it would exploit a vulnerability in the Linux kernel to escape the container, and from there attempt to take over the computer.

If you keep Docker Desktop updated and regularly update the container that Dangerzone uses, such attacks will be much more expensive for attackers.

Another way a malicious document may harm your system, even with Dangerzone, is if it is crafted to attack the document previewing capabilities of the operating system itself (e.g. the part that generates file thumbnails or document previews in a side-panel of the file manager). Due to the high level of integration of these features in the operating system, disabling them completely may be challenging. For this reason, keeping your system always up to date is the most practical solution to minimize this risk.

Dangerzone is open source

This tool is still in early development, so there may be bugs. If you find any, please check the issues on GitHub and open one if your issue doesn't exist. Please start discussions and make pull requests if you'd like to get involved.

You can find the code for the Mac, Windows, Linux graphical app and the Docker container here: https://github.com/freedomofpress/dangerzone
Dangerzone is released under the AGPLv3 license. It was developed by Micah Lee at First Look Media and is now a project of Freedom of the Press Foundation.

# data[].attributes.attachment_link.description
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.

# data[].attributes.attachment_link.readable_text
The contents of this guide have been adapted from the Digital Enquirer Kit written by Tactical Tech and produced by GIZ.

A web address (also known as a URL) tells you where a resource is located online. But did you also know that it includes important information about a website's security and authenticity at a glance-if you know what to look out for.

Because web addresses may be long, complex-looking, and not very pretty, they're often hidden. Maybe they're disguised within hyperlinked texts or previews. This can make it difficult to see exactly which address you're going to, and as a result you put your trust in the person who created the resource or sent you the link.

When you see a link, do you automatically click on it? Next time, take a moment to examine the web address closely and you might notice some clues.

Data collectors and scammers rely on you hastily or unknowingly clicking through their tricky links. This might not sound so bad, until you consider that some might trick you into installing a virus, or giving away your password, personal identification number, or other private information like bank details that could cause you a real headache if it were to get into the wrong hands.

As you follow this Data Detox, you'll learn practical steps to slow down and decide whether it's really okay for you to click on that link, or whether you need to proceed cautiously.

Let's get started!

Website addresses can be very long and complicated, or the text can be small and hard to see. But resist the urge to quickly click and always take a closer look first.

A copycat URL is a web address that is designed to look just like the original with the intent of deceiving you. The copycat version is often run by scammers in order to trick you into sharing your password or other sensitive information. It's usually pretty easy to spot copycat web address -it's just a matter of training your eyes to identify common tricks, such as adding or changing letters and numbers in what looks like an authentic address.

Compare these two web addresses:

The original URL: https://www.mybank.com

The copycat: https://www.rnybank.com

Did you notice that the scammer added an "r" and an "n" in the address in lieu of an "m"?

You may also see a website's address displayed within the text of an email body or advertisement. Carefully check the actual web address that's linked there before clicking on it! It might be that it was written in a way to deceive you, just as you saw in the example with mybank.com.

Let's look at some of the most common web address tricks.

# data[].attributes.attachment_link.description
As you follow this Data Detox, you'll learn practical steps to slow down and decide whether it's really okay for you to click on that link, or whether you need to proceed cautiously.

# data[].attributes.body
www.next.com.tw -site:www.next.com.tw

# data[].attributes.attachment_link.readable_text
As a partner on our platform, you probably have access to a large amount of guest data, including names, addresses, credit card details, and phone numbers.

This means your Extranet account can be a tempting target for cybercriminals and scammers, who use a variety of techniques to try to gain access to this valuable data. Phishing is one of those techniques, which we explain in this article. Two other common techniques are malware and social engineering.
In this article:
Understanding phishing

Phishing is a type of cyber attack carried out by a scammer pretending to be someone else in order to steal money or data. Phishing is the most common method by which organizational breaches occur.

Phishing attempts are usually aimed at stealing:

Guest reservation data

Personal info of employees and guests

Credit card info

Money, by tricking staff or compromising systems

Phishing attacks most commonly target individuals or organizations with valuable data. Accommodation partners like you can become targets because of the sensitive and valuable data stored on the Extranet. Scammers may attempt to mimic our emails in order to phish your username and password for the purpose of taking over your account. These phishing emails can lead to a webpage that looks very similar to the Booking.com Extranet log-in page - but if you look at the URL address bar, you'll notice differences. The key to protecting your business is to report these emails to us as soon as you spot them.

Understanding email spoofing

Email spoofing is a technique cybercriminals use to trick you into believing an email came from a trusted sender by falsifying the sender's email address. Spoofed emails can be used for several malicious purposes including phishing attacks, spreading malware, scams, or targeted cyberattacks.

We use Domain-based Message Authentication, Reporting and Conformance (DMARC) to protect our platform and partners like you from email spoofing. DMARC is an email authentication standard that allows email receivers to verify the authenticity of a message. We have a strict policy, which means your email system should reject messages that don't pass authenticity checks.

While this standard reduces the risk of receiving spoofed emails, there are some scenarios where spoof emails are still delivered. This depends on the configuration of your systems. For example, if you experience network issues that delay authentication, some systems are configured to deliver the unauthenticated message instead of deferring it.

Identifying phishing attempts

You probably receive suspicious emails every day. Depending on your email client, these suspicious messages may be flagged or automatically moved to the spam folder, but some may get through. You can spot these by keeping an eye out for:

Urgent language
Phishing emails tend to create a false sense of urgency, such as threats of your Extranet account being suspended, or an urgent email about your financial situation. Scammers will always adapt their techniques to make their phishing emails look as legitimate as possible.

Errors and mistakes
Keep an eye out for spelling errors or grammatical mistakes. If you spot numerous mistakes or a mix of different languages in the same email, it's likely a phishing email. Phishing emails are also typically written in a mix of different languages. You can always check who the real sender is in the "From:" field of your email client, or by checking the sender inside the arrowheads ("<," ">"). Emails from Booking.com always come from an address ending in "@booking.com," regardless of the subdomain (e.g. example@sg.booking.com). An email address like "support@booking-103266.com" isn't from Booking.com and is definitely malicious. Don't interact with such emails - report them as spam instead.

Urgent requests without previous communication
Booking.com will never make urgent requests without sending prior communication. If you receive a suspicious email requesting urgent action, don't take any steps until you contact your Account Manager or Customer Service. This will allow us to check whether any internal updates were made and to report the email to the Security team if necessary.

Incorrect sender email addresses
Don't automatically trust the email display name. Check the email address in the "From" header. If it looks suspicious, don't open the email. Here are a few examples of trusted Booking.com email addresses:

Foreign links
Scanning the links you receive can help you prevent cyberattacks and improve your awareness of potential cybersecurity risks. There are a few ways to check links:

Check the real destination of a link by hovering your mouse over it or by tapping and holding the link if you're on a mobile device. If the link doesn't take you to an address ending in ".booking.com," don't click it.

There are also online tools and services designed to analyze and scan URLs for potential threats and malicious content.

What to do if you suspect a phishing attempt

If you suspect your computer or laptop has been infected with malware, try performing one or more of the following steps:

Reset your email account password first, then reset your Booking.com account password. To do this, go to http://admin.booking.com, type in your username, then click "Having trouble signing in?"

Scan your device with an updated malware scanner. Not all phishing attacks steal passwords - some can have malicious software embedded in a file that may be malware, spyware, ransomware, or a virus. It's very important to scan your device if you think you've clicked a malicious link or downloaded unrecognized files.

Report security issues within 24 hours of a suspected or actual phishing attack. This allows us to start securing your account to protect your business and guests as quickly as possible. Don't forget to include all relevant details, such as a copy of the suspicious email you received or any unrecognized activity in your account. Read these instructions on how to safely forward a suspicious email as an attachment.

How to download suspicious emails in order to report them

To report a suspicious email, you'll need to download it in .eml/.msg format. There are different ways to do this depending on your email provider and client.
Gmail:

1. Open the email you want to download

2. Click the three dots in the upper-right corner of the email

3. Select "Download message" to download it in .eml format

Outlook (web):

1. Open the email

2. Click the three dots in the toolbar above the email

3. Select "View message source" to view the email in .eml format

4. To download it as .msg, you might have to open the email in the desktop version of Outlook and use the "Save as" option

Yahoo Mail:

1. Open the email

2. Click "More" (three dots)

3. Select "Download message" to download it in .eml format

Microsoft Outlook (desktop):

1. Open the email

2. Click "File" in the menu

3. Click "Save as" and select the .msg format

Apple Mail:

1. Open the email

2. Right-click the email

3. Click "Save as" and select the .eml format

Thunderbird:

1. Open the email in Thunderbird

2. Right-click the email

3. Click "Save as" and select the .eml format

Note: These instructions may change with updates to the email platforms and clients. Always check the specific options available in your email client for the most accurate guidance.

Protecting your organization from phishing attempts

To prevent security breaches, we recommend taking the following proactive steps to protect yourself from scammers impersonating Booking.com:

Bookmark the correct Extranet link
Manually type https://admin.booking.com/ into your browser. You'll see the secure lock icon next to the address. Bookmark this page and use this link to manage your property. Learn more about preventing unauthorized use of your account in this article.

Report suspicious emails
Always report suspicious emails to the Booking.com Security team, then move the email to trash.

Limit the use of tools that grant online anonymity
To stay safe, we recommend not using tools that grant anonymity online (e.g. Incognito mode) while navigating the Extranet.

Review your email service provider solutions
Popular email providers have put in place smart solutions to tackle phishing scams. For example, Gmail offers a range of tools and settings outlined in their support documentation to help users stay safe. Make sure you check what protections they have in place and how you can make the most of them.

# data[].attributes.attachment_link.title
Online security awareness: Phishing and email spoofing

# data[].attributes.attachment_link.description
As a partner on our platform, you probably have access to a large amount of guest data, including names, addresses, credit card details, and phone numbers. This means your Extranet account can be a tempting target for cybercriminals and scammers, who use a variety of techniques to try to gain access to this valuable data.

# data[].attributes.attachment_link.title
Ten ways to avoid scams when booking travel

# data[].attributes.attachment_link.description
With news of Booking.com hackers increasing attacks on customers, we ask two cyber-security and travel fraud experts for their top tips on how to protect yourself when booking a trip.

# data[].attributes.attachment_link.readable_text
Travellers using the popular hotel website Booking.com are being warned not to fall for scam emails asking them to confirm their hotel payment, after a hack of Booking.com's email system.

In recent weeks the Observer has been contacted by a number of customers claiming that they had received scam emails from within the Booking.com system.

In each case the customer has either checked in, or was due to check in, to a hotel they had reserved using Booking.com. The email - sent from noreply@booking.com - claims their stay may have to be cancelled unless they hand over their bank card details via an embedded link.

If they fail to do so within four or 12 hours - the emails vary slightly - the reservation will be cancelled. Notifications of the email have also appeared in the company's app on mobile phones.

Booking.com has strenuously denied its system has been hacked and has, instead, blamed the messages on breaches in the email systems of its partner hotels.

But the affected hotels are complaining that this could not have taken place at their end.

Observer reader Julia Berridge says she was forced to cancel her bank card after she followed the instructions in the email she seemingly received from the website. She was staying in a hotel in Marseille earlier this month for two nights at a cost of €349.

The email containing the fraudulent payment request - seen by the Observer - had, apparently, been sent from a standard Booking.com email address. It had a link to her reservation, and came complete with all her stay details. She says the fact that a notification of the message appeared in the app on her phone made her think it was genuine.

Although she didn't lose any money, she did input her card details and decided her only option was to cancel her card.

Kate Wright, who works in digital commerce, was not so lucky. She had a second payment taken after responding to the same email.

When she realised she had been charged twice she took it up with Booking.com, only to be told by the call centre staff that what she was saying had happened was "simply impossible", she says.

"I was made to feel like I was being hysterical - the call centre refused to believe that scammers had sent out an email using the Booking.com system. But, after two days, I eventually received a message from the hotel, again via Booking.com, saying that the system had been breached, that it knew about it, but was not telling their customers.

Part of the message that Julia Berridge received from Booking.com.

"I was told to contact my bank. In the end I was refunded by the bank but only after I had spent four hours on the phone, and had my card replaced digitally. To say I am unhappy is a huge understatement," she says.

Another reader, who asked not to be named, had the same experience after booking a hotel in Cardiff. She received a similar email, she assumed, from Booking.com.

"I only avoided losing hundreds of pounds because I became suspicious at the last moment before entering my card details and contacted the hotel directly.

"The hotel did not seem surprised, and asked if I had received a scam email. The only way that these scammers could have this info is through a breach at Booking.com, or the partner hotel's interface, since it has all the booking details as well as previous email exchanges with the hotel in question.

"This must be something that Booking.com is aware of, but is keeping quiet. Don't they have a duty to warn customers if they have been hacked?"

On the Booking.com partner hub - an information site for operators using the website - hoteliers have been complaining about the problem.

"Booking.com claims that someone got our login credentials, but that is not possible because we have two-factor authentication and we did not get any SMS.

"So someone logged in to our account, on a new computer, but we didn't receive the SMS code nor the email 'Booking.com - new sign-in to your account,'" complains Hotel de Colegio.

This is the latest problem to hit the website, which fast became the go-to hotel booking site for millions of travellers. Last month it was accused of leaving many hotel operators and other partners across the globe thousands of pounds out of pocket for months on end, blaming the lack of payments on a "technical issue".

In a statement Booking.com told us that ensuring its platform was safe and trustworthy for our partners and customers was its "top priority".

"Some of our accommodation partners have, unfortunately, been targeted by very convincing and sophisticated phishing tactics, encouraging them to click on links, or download attachments outside of our system, that enable malware to load on their machines and, in some cases, led to unauthorised access to their Booking.com account," it says.

"These fraudsters then attempt to impersonate the partner to request payment from customers outside of the policy in their booking confirmation.

"While neither Booking.com's backend systems, nor infrastructure, have been breached in any way, we are acutely aware of the implications of such scams by malicious third parties to our business, our accommodation partners and to our customers, who can fall victim to professional scammers.

"If a customer has any concerns about a payment message, we encourage them to check the payment policy of the accommodation, which is easy to find on the property listing page, or contact our customer service team, which is available around the clock.

"We will also be reaching out to the customers in these cases directly to ensure they are fully supported," it adds.

# data[].attributes.attachment_link.title
Booking.com customers targeted by scam 'confirmation' emails

# data[].attributes.attachment_link.description
Travellers are getting seemingly convincing messages asking them to provide bank card details and threatening their reservation will be cancelled

# data[].attributes.attachment_link.readable_text
One of the greatest tools for infosec professionals to investigate and prevent phishing scams is actually just a collection of websites that produce information that is free and open to the public, also known as Open Source Intelligence (OSINT). This article will identify and explain several OSINT methods that are effective and require no previous OSINT experience.
The following is an excerpt from the book, The OSINT Guide, by Thomas Caliendo.
Interestingly, OSINT is not only a major factor in the prevention/response aspect of phishing scams, but it also plays a major role in the creation of phishing scams. We will discuss how malicious actors use OSINT, and how infosec professionals can use this knowledge against them in order to keep their companies safe.

Why Focus on Phishing Scams?

As an infosec professional, this is the most likely threat you will encounter.

Phishing is often considered old fashioned and outdated, easy to avoid. To be fair, the news often focuses on the more interesting new scams, while phishing takes a smaller and smaller share of the media focus. However, most people are surprised to learn that phishing is the most common Internet scam out there. However, as my colleague Daniel Miessler points out in his article, Everyday Risk Rating, some dangers are more real than others and it can be hard to know the difference.

Phishing scams are overwhelmingly the most common and dangerous Internet-based crime, according to the FBI's Internet Crime Complaint Center (IC3) Internet Crime Report 2021 and the 2021 Webroot BrightCloud Threat Report. According to the Cofense Intelligence 3rd Quarter review for 2021, phishing was involved in 93% of modern data breaches (during the 3rd quarter).

CISCO's 2021 Cybersecurity threat trends report (which applies to all of 2021) showed similar numbers and listed that phishing attacks account for around 90% of data breaches.

Per the CISCO data, at least one person clicked a phishing link in 86% of organizations targeted by phishing scams. 74% of US companies experienced a successful phishing attack during 2021, according to Proofpoint's 2021 State of the Phish report. Therefore the prevalence of attempted and successful phishing attacks warrants our focus on this kind of attack.

As pointed out in Defining OSINT and Its Role in Cyber Threat Intelligence, the amount of information out there is growing fast and this data is not only the focus of businesses and government agencies, but it also attracts threat actors.

Learn the Malicious Tactics in Use

Using New Mediums and Sources

Most people assume that a phishing scam takes the comparatively obvious form of a suspicious email and assume that they would know not to open or click on it. But today phishing attempts have become more advanced. For one thing, phishing scams don't only come in the form of email, but also posts and direct messages on social media, SMS messages, and more. In addition, phishing websites are now obtaining SSL certificates which were once considered a marker of safety (more on that below, along with other modernizations used for phishing scams).

Building Trust

In addition, social media scams may come in the form of a message seemingly sent to the workforce from one's friend or family with a seemingly typical message, or one's boss, telling the workforces to click on a link or open an attachment. One of the common ways to build trust in these scenarios is to first send a message asking the recipient to do something (click a link or download a file) that is actually innocuous in order to build trust, and then send a follow up message with the true phishing content.

Avoiding Email Filters

In theory, the DMARC (Domain Message Authentication, Reporting, and Conformance) is supposed to filter out suspicious emails based on factors like the domain sending the emails and the URLs included in the content.

However, scammers have found the following ways around DMARC security parameters:

● For starters, scammers often use mass email services like SendGrid, MailChimp, and MailJet. According to Cyren Security, the emails with unique domains ("john@definitely_not_a_scam.com) that are being sent from Mailchimp and other similar services are often accepted by email filters. A reason why this is effective is that the services provide the relevant authentication used to validate emails. A lot of companies even "white list" these mass email services.

● Scammers will often send URLs that include part of a legitimate domain. For example, instead of using "bankofamerica.com", they will use "hln.bankofamerican.com". This method is actually an effective way to avoid email filters.

● While many scammers buy their own domains and send emails from them, others use free email. If you are using a free email like gmail.com and hotmail.com. Mass emails from free emails are likely to be filtered out. Therefore, services like mailchimp will offer a method to evade companies' filters by adding on a subdomain as the email domain, such as "@send.mailchimpapp.com". For example, if the scammer is using "[email protected]", Mailchimp can change the "From" email to "[email protected]". This is an effective way to hide the true email sender.

What is the Role of OSINT in Our Scenario?

Phishing scams can be investigated via OSINT before or after someone has fallen victim. For the sake of clarity, when we discuss our hypothetical phishing scam, we will use the most common kind of phishing scan that is currently in use. That is, a scammer who sends out mass emails, often to specific companies' employees. The emails invite the recipients to click on a link and input their personal sensitive information, such as username and password, on fake websites that are designed to look like certain real websites. Finally, in this example the scammers have (as most do) an infrastructure of IPs, servers, domain names, etc. that support a number of fake websites that log victims' information and securely send it back to the scammer.

We will start with the example of someone who received a suspicious email and wants you to investigate whether it is a phishing scam. Now let's get started looking at what you can do in an OSINT investigation.

Before You Start: Take These Simple Preventative Measures

Provide Security Awareness Training

Before your investigation even starts, consider ensuring that your company has some form of security awareness training for its employees, even if it just involves you providing a quick overview. Educating the workforce is one of the most effective forms of preventative measures because at the end of the day phishing scams rely on human beings to be imperfect and make bad decisions (i.e. downloading a file or clicking a link). Security awareness training will keep the workforce more alert and well-educated, which will significantly reduce the possibility of someone making that bad decision.

Remove Personal Information from Public Sources

In addition, another effective measure is to remove the company employees from the main recruitment / sales intelligence websites also known as "headhunter" sites (Apollo.io, contactout.com, rocketreach.co). Each site has an "opt out" function that allows you to remove information from the site (note that many companies choose to contract out this rather boring "personal information removal" process so you don't necessarily need to do it yourself).

Phishing scammers used to rely primarily on buying email lists on the dark web. But today much of the same data is available for free. For example, Contactout.com reportedly has "contact details for 75% of professionals".

Therefore scammers increasingly use these free, publicly available resources. If a scammer is looking for companies' to target, and your company's information is hidden while others' are easily available, it is reasonable to assume the scammer might move on to other easier targets.

Start the Investigation

Identify Suspicious Emails to Investigate

While there are a wide variety of phishing emails, there are a few simple ways to identify or avoid the vast majority of them. For starters, be aware that phishing emails often look completely legitimate whether that involves an email that appears to come from a company or bank where you have an account or even appearing to have been sent from a friend, colleague, or boss. Therefore the appearance of legitimacy should never be considered a factor in determining if the email is suspicious. Instead, consider an email suspicious if it asks you to open or download any attachment or asks you to click on a link.

To reiterate this point, any email, especially from a company, that asks the recipient to open a file or click on a link should be considered suspicious. As a result of phishing scams, most companies will not send links or attachments in emails. Therefore any email that actually does so, can reasonably be considered suspicious.

Unshortened URLs

The OSINT investigation starts with the email sent to employees, regardless of whether it is a confirmed phishing scam or just a suspicious email.

Begin with the link or URL that you are invited to click (obviously do not click on it). Be on the lookout for shortened URLs (like bit.ly4enla45c or tinyurl.com/4emdh45c). Phishing campaigns are increasingly taking advantage of free open source tools (bitly.com, tinyurl.com, tiny.cc, cutt.ly, and shorturl.at) to shorten URLs. These URLs hide the true link destination, are less likely to be filtered out by content filters, and people are accustomed to seeing "bit.ly" URLs so they are more likely to click on it, according to a comparison of recent phishing statistics by Comparitech.

For your investigation there are several open source tools to unshorten those URLs and discover the true domain destination (such as unshorten.it, urlex.org, and checkshorturl.com).

Conduct Website Scans

Once you have identified the true domain of the URL's destination, you can enter the domain into a number of OSINT websites (also known as "scanner sites") that scan the suspicious domain to see if it looks safe (you can use scamadviser.com, urlscan.io, and checkphish.ai). These scanner sites are NOT perfect but they run a number of tests on the domain and also track threat feeds in case anyone has reported the domain or its IP address for malicious activity. It is also worth noting that these tools provide you with a snapshot of the scanned websites, providing you a safe way to check it out.

Urlscan.io has an interesting feature among its scan results. The site searches for other websites that have a similar structure to the one you scanned, but are hosted on different infrastructure. Why does this matter? Because it is a good indicator that the website was built by a phishing kit (which is basically a prebuilt phishing scam that is sold on illegal but widespread marketplaces). Phishing kits and phishing scams in general often create several versions of a fake website. Sometimes this is contingency planning for when one site gets taken down there are still others, and sometimes this action is done to create specific websites for different target sets.

Check the IP and Domain Reputation

The sites like Urlscan.io that we just used will also identify the possible phishing website's domain, IP address and its ssl security certificate. These are useful pieces of information for an investigation.

Starting with IP address and domain, you can use cyber security sites like virustotal.com to check if they have been previously flagged for malicious activity by other parties. Phishtank.org is another useful site that is focused specifically for checking domains for reported phishing activity. These sites will use factors and report if the site is identified as "Clean", "Malware site", "Phishing site", "Spam site", or just "Suspicious".

Search for Files on the Site

A website URL can be searched in various cyber security sites like virustotal.com (or sitelock.com) to see if there are files on the website, and whether they are believed to be safe. The cybersecurity sites will look for any files that have been downloaded from the suspicious website in the past and check if people have reported negatively about those files. The security sites will also do their own scans of the files from afar to assess if the file is safe, malware, etc. Finally, you can actually send an unopened file to these sites so they can provide a more in-depth assessment to determine if it is or is not safe.

Confirm a Website's SSL Certificate

People are consistently more likely to believe that a website is safe if it has an SSL certificate. If a website has an SSL certificate, the URL will begin with "https" instead of "http". There will also be a small lock symbol to the left of the URL.

Many people do not understand what this actually means. While there are many types of SSL certificates, the most common kind only makes your browser's communication with the website encrypted (so outsiders can see what you are doing). The lock and "https" gives many people the impression that the website is safe, which is not true.

In the past, one of the ways to help identify a suspicious websitewas to check if it did not have an SSL certificate. But today phishing emails have begun obtaining SSL certificates by using the free service "letsencrypt.org".

Let's Encrypt is a free service run by a nonprofit with the purpose of making SSL Certificates available for free.

However, we can use https://crt.sh/ to check a website's certificate, and the resulting report will identify any other domains on that certificate. Multiple domains on one certificate usually means they are all more likely owned by the same person, but it is possible for multiple people to own the same one. Therefore certificates provide a good lead to other sites potentially owned by the same scammer, but it is a good idea to try to confirm that. To do so, check if the domains look nearly identical, if they fail a website scan, have a similar domain, or have had similar files on the site.

Lookup Who Shares the IPs

In a similar fashion, you can check what IP is used by a phishing site and look at other websites on the same IP to find potential other phishing sites from the same campaign. Sometimes the scammer owns the IP, shares the IP with legitimate sites, or even hacks the IP. Regardless, Spyonweb.com is one of several good tools to look up a website's IP and the other sites on the same IP.

Check the Website Registration

Website registration (known as the Whois record) are usually anonymous. But if you look through the historic records you will often find that the original owner started the website with their true information and then used an anonymizer shortly thereafter. A spammer would usually try to only list their contact information, but that is often enough to find clues to the person's identity. Usually you can only find the current Whois record online. But tools that offer historic whois records often appear, though they sometimes do not stay free. As of this writing, you can use Https://drs.whoisxmlapi.com/whois-history.

Be aware that people make mistakes, even scammers. See this story about a bunch of professionals that mistakenly had their true contact info on one of several websites they had secretly created.

Use Analytics and Adsense IDs

In this case the website owners also made the mistake of using Google Analytics and Adsense. People that maintain multiple sites often use Google Analytics and Adsense to monitor all of them. However, these two services put an unique ID number in the coding of each website. Services like Spyonweb.com will look for these IDs on a website and find other websites that are on the same account. This is a second mistake made by the professionals in the story mentioned above.

Find Similar Domains

Finally, several phishing websites use domains for their fake websites that are very similar to real websites. Consider "BANK0FAMERICA.COM" (there is a zero instead of the letter o). Therefore, when you see a url like that you can search the real website's url in https://dnstwister.report/ to find other similar domains that the scammer might use. You can also research the known phishing website's URL in the same tool which might also find URLs used by the scammer.

Research the MX Record

An MX Lookup is another way to identify nodes in an investigation. The MX (Mail Exchange) record for your domain will tell incoming mail where to go, which server and associated IP to land on. You can lookup MX records with tools like

"https://dnschecker.org" and "https://iplocation.io," however, mxtoolbox.com will automatically check the resulting record against several blacklists. Though you can also look up the relevant IP in the tools mentioned previously. It is also important to check if several different domains are using the same MX record, a definite connection between the two sites.

Start Connecting Dots

At this point in your investigation you will begin to look for, and connect, dots. Phishing campaigns often entail several name server records, domains, IPs, and URLs. The image below (from Virustotal.com) is a graph of a phishing campaign showing the various IP addresses, URLs, domains, and files. You can use websites like https://www.virustotal.com/graph/ to build a graph to visually represent your work, making it easier to understand.

(https://www.virustotal.com/graph/g19666e9509b94dbbb12cf573896e60bf13bd64cde2814929b3023327ada012fc)

To build out a network, use MXlookups, DNS Twisting, Shared IPs, shared SSL certificates, Analytics/Adsense ID, and shared files to find nodes and build connections. Remember that a simple connection is usually not sufficient. For example, sharing an IP address does not mean that two websites are owned by the same person. But you can conduct some follow on research to build a case for a stronger connection.

How to Identify More Phishing Websites

When you come across a new website, IP, etc. there are a few good ways to determine if it is a phishing site or not. For example, scanning tools like URLscan.io will straight up tell you that the website is part of a phishing kit.

Check the IPs and URLs against blacklists or evidence of phishing in tools like Virustotal.com.

Additionally, the tweet below shows an example of how a campaign will use several URLs that are very similar (workers-united.com, workersunited.site, etc.). The tweet also shows how phishing campaigns will have different websites aimed at the different companies targeted (J.P. Morgan Chase, T-Mobile, etc.). Finally, notice how each website appears the same, and the only thing different from each other is the name of the companies being targeted. It is important to look for several websites that are nearly identical as this is often an aspect of a phishing kit.

(https://twitter.com/gossithedog/status/1377682079736008710)

Once you find evidence of a phishing site, you can draw connections to other nodes and reasonably assume that they are part of the same network. Each node is not only valuable to find for the sake of avoiding the network, but also because each node has potential to include evidence about the scammer. Don't forget, as previously mentioned, that scammers can make mistakes and there are plenty of examples of law enforcementmaking use of those mistakes to catch scammers. Furthermore, also noted above, scammers often use cheap knockoff versions of phishing kits which are more likely to have mistakes that could reveal the user. Therefore, treat every node as a useful clue about the network or the user.

Conclusion

Now that you know how to investigate websites, confirm phishing sites, and discover nodes in a phishing network, you have several options for how to proceed with this information.

● With all or many of the nodes identified, you can keep this information within your own organization so that you can watch and avoid the phishing network.

● You can report the network to the relevant sources for public blacklists that you previously used to check the reputation for IPs, Servers, etc. so others can stay safe.

● You can report your information to the government (use https://www.usa.gov/stop-scams-frauds), which may take action or make the information available in its public database of Internet scams.

● You can announce the network publicly via social media or some other means. This is a great way to share your knowledge, but it will likely notify the scammer that they have been caught and they will presumably move their network to new nodes of IPs, domains, etc. Some people have chosen to only report these networks to relevant databases as it may make the information to infosec professionals without necessarily notifying the scammer.

Regardless of what you choose to do, you will make the world a little bit safer. Good luck, but you won't need it!

# data[].attributes.attachment_link.title
Use OSINT to Investigate a Phishing Scam

# data[].attributes.attachment_link.description
One of the greatest tools for infosec professionals to investigate and prevent phishing scams is actually just a collection of websites that produce information that is free and open to the public, also known as Open Source Intelligence (OSINT). This article will identify and explain several OSINT methods that are

# data[].attributes.attachment_link.title
How to investigate a massive phishing campaign

# data[].attributes.attachment_link.description
The malicious actors behind this campaign have created hundreds of fake domains, impersonating several Irish banks, the national postal service of Ireland, courier services, Sky TV, covid pass issuers, as well as several other financial entities abroad, the English NHS and many others.