Methodologies

Looking Beyond Visible Content During Phishing Investigations

During a phishing investigation, I encountered a domain that appeared to be associated with a well-known retail brand. The domain contained login and registration pages designed to collect user credentials, yet something unusual stood out during the initial review.

Despite the presence of credential-capture functionality, the targeted brand was not mentioned anywhere on the visible pages.

Initial Observation

At first glance, the website appeared to contain little more than generic discount content. While the domain name itself referenced a recognizable brand, the visible pages lacked the branding elements typically used to support a phishing assessment.

Without clear evidence of impersonation on the front end, the case could potentially be viewed as a trademark issue rather than a phishing operation.

Verification

Rather than relying solely on visible content, I decided to review the website's source code and metadata.

This deeper inspection revealed hidden organizational information that falsely presented the website as being associated with a legitimate retail entity.

Additional references linked the website to official social media accounts belonging to unrelated well-known brands. These associations were not visible to ordinary visitors but appeared designed to reinforce a false impression of legitimacy.

Source code review revealed hidden organizational metadata and social media references not visible to website visitors.

To determine whether the hidden references were meaningful, I validated the website's structured data and organizational metadata. This confirmed that the domain was presenting itself as an organization associated with unrelated legitimate brands through embedded social media references and organizational attributes that were not visible on the website itself.

Structured data validation confirmed the presence of organizational metadata linking the domain to official social media accounts of an unrelated legitimate brand.

Assessment

The hidden references helped establish that the website was attempting to create a false sense of legitimacy while simultaneously operating credential-harvesting pages.

What initially appeared to be a trademark issue became a much stronger phishing case once the concealed indicators were identified.

Takeaway

When a domain contains credential-capture functionality but lacks obvious branding references, it can be worthwhile to examine source code, metadata, structured data, and embedded assets for additional context.

💡

Certain details in the screenshots have been intentionally redacted to protect third-party information and preserve the anonymity of entities involved. The redactions do not affect the investigative methodology being demonstrated.

Tracing a Sunset Walk Through Tirana

Challenge Overview This exercise involved analysing a short video shared by the "Visit Tirana" on X (formerly Twitter) account on 16 February 2023. The post showed a person walking through the streets of Tirana during sunset, accompanied by the caption "Sunset in Tirana". Unlike a typical

Tracing an Unknown Island Resort Through GEOINT

Objective: Identify the resort, determine the island's coordinates, and establish the cardinal direction the camera was facing when the photograph was taken. Challenge Overview This challenge provided a single photograph of a tropical island resort with very little contextual information. My objective was to determine: * The name of

Tracing an Airbase Linked to Cold War Arms Smuggling

Challenge Overview This challenge revolved around a fictional arms smuggling operation involving Russian military parts being transported through multiple airbases before reaching a central hub. The challenge narrative pointed toward a network connected to former Cold War associates and international military logistics. My task was to identify the airbase shown

Using Business Registration Records to Validate Website Claims

During a domain abuse investigation involving a suspected phishing website, one of the details that stood out was the presence of a business registration number displayed on the website. At first glance, the website appeared to represent a legitimate organization and used branding elements intended to build trust with visitors.

Investigating the internet, one trace at a time.