Domain Registry Scam by giv.com

There has been a domain scam particularly in Canada that has been going on for quite awhile. When I was introduced to it taking place and being a person, they also tried to target. I decided it would be best to expose how they try to scam people so that people do not fall prey to them. I have heard stories of people falling for this scam. This post is for the ones that end up landing on this blog post for more info.

Why is this important

Personally, reading all the comments and posts online about these scammers. I feel the right thing to do is to create some awareness, so more people do not fall prey to the scam. There are many innocent victims, who may fall for this scam due to the lack of cyber security awareness. So, lets go out there and educate people and let them know about this scam. Hopefully, it can at least prevent a few people from falling prey to this scam.

What did they do

This organization is sending thousands of letters on an ongoing basis to people. These mailed letters show up at your home or offices and make it seem like it is an urgent matter to address right away. The letter will state a domain name you own, the expiry date of the domain, a section to paste your credit card number, and an envelope the mail the form back.

Namechk – A Domain Searching & Recon Tool

Namechk –  A Domain Searching & Recon Tool

So I came across a new tool that I found particularly interesting. And, especially for someone that may be working on a pen test during the recon stage. Recon is very important, since it allows you to gather as much intel as possible before you start to look for weaknesses.

What is the tool?

I came across a website called Namechk (https://namechk.com). And, started to realize the power it gives you when conducting recon for particular companies or people. This site basically allows you to search for company names and personal names of people. Now the site isn’t made to conduct recon on anyone or any entity. But, it seems like some cyber security analysts and pen testers are starting to utilize it for recon purposes. And, why not? It’s a tool and various tools can be used for various purposes.

What is its real purpose?

Read The Full Post

DNSTwist – Domain Phishing Enumeration

DNSTwist – A Look at Domain Phishing Enumeration

A few weeks ago, I happened to stumble upon a tool called DNSTwist. And, like every tool I ever encounter, I always like investigate more into a tools capabilities and what it can offer. After reading more about the tool through another blog I was reading at that time. I was pointed towards the official Github page for DNSTwist. The tool itself is great and something every company should at least look at on a yearly basis. Phishing attacks are on a rise, and the expectation is that they will continue to increase over time. So, I’ve decided to create a very quick tutorial on how to use DNSTwist, and what it can offer for anyone that wants to make use of it. This is a great tool for Pen Testers and Security Analysts!

What can DNSTwist do for me?

I found using this tool gave me great insight into major phishing attacks that could be conducted against users or companies. Now how is this a good thing? Well, if you know the type of attacks that can take place, or how a certain attack can take place. Then, you are better able to find ways to defend against this type of attack. At the minimum, you can at least detect this specific type of attack. In my experience there are more stats revealing that there is now a rise in phishing attacks against companies and users.

So how does this tool help me? (more…)