Pro-Iranian threat actor Handala – new websites
Overview of psy-op domains associated with Handala, a pro-Iranian threat actor group.
Investigations
Threat actor from a Russian operated crime forum targeting users in Ireland
Residents of Ireland being targeted again by a shady community from a Russian crime forum.
New Covid-19 themed phishing campaign in Ireland
Another brand new phishing campaign targeting the people of Ireland under the pretence of Covid-19 testing and impersonating the HSE.
How to investigate a massive phishing campaign
Investigating a large phishing campaign against Irish users – while laying out step by step the methodology and the workflow.
Investigating fraudulent covid-19 certs & passes
An OSINT deep dive into fraudulent covid-19 certs and passes, with some surprising findings.
Hydra darknet market on a server in France?
After an anonymous tip off from a reader I investigated two IP addresses seemingly associated with the Russian darknet market Hydra. What happened next might surprise you…
The curious case of the perl.com domain hijack
An OSINT driven research into how the perl.com domain ended up in the hands of cyber criminals who then attempted to auction it off…
OSINT Iran: passive reconnaissance of Iranian IP space, IoT, WiFi networks, social media and more
In this quasi-investigative piece I explore various layers of Iranian digital ecosystems, providing a good deal of resources for starting open source enquiries into Iran.
New spam / phishing campaign on Whatsapp – investigating fake Dominos pizza websites
An impromptu investigation into a spam / phishing campaign featuring fake Dominos pizza vouchers on Whatsapp.
A guide to investigating scam text messages and websites – fake Revenue Online page
A step by step guide to investigating scam text messages, phishing URL links and dodgy websites. I investigate a real Revenue Online Services scam that hit users in Ireland several days ago.