Discover and read the best of Twitter Threads about #gophish
Most recents (1)
I'm playing with phishing infrastructure OPSEC topic, hunting gophish on shodan... and found this:
GoPhish servers hosted in Moscow, configurated with same, self-signed "PZU" certificate.
IPs are not resolving for any domain rn, but it might be backend.
#gophish #phishing 1/x
GoPhish servers hosted in Moscow, configurated with same, self-signed "PZU" certificate.
IPs are not resolving for any domain rn, but it might be backend.
#gophish #phishing 1/x
2/x
Another interesting thing is that for 2nd IP, the gophish management service is open for the world. emailAddress indicates that someone who deployed this gophish at least know popular Polish services. But take a look on the 'O' and 'OU', 'OOH'. Does this look familiar?
Another interesting thing is that for 2nd IP, the gophish management service is open for the world. emailAddress indicates that someone who deployed this gophish at least know popular Polish services. But take a look on the 'O' and 'OU', 'OOH'. Does this look familiar?
3/x 'OOH' was used as 'Organization' for domains registered in UNC1151 #ghostwriter phishing campaing.
This isn't indicator of course, but it's not usual organization name in SSL, as there are only 3 of them (3rd IP from screen is FP, I'm not into get censys query scheme)
This isn't indicator of course, but it's not usual organization name in SSL, as there are only 3 of them (3rd IP from screen is FP, I'm not into get censys query scheme)
