[Day 6] 1. Phishing and Information Gathering

Information Gathering

When purchasing a domain name, registrars or authorities like ICANN require details such as the domain owner’s name, contact information, and address. This information becomes part of public records and can be queried using tools like whois.

Whois Lookup Types

• whois Domain Lookup: Provides details about the domain, such as the registrar, registration date, expiry date, and contact information.
• whois IP Lookup: Retrieves information about the organization or ISP associated with a specific IP address.
• whois MAC Lookup: Provides details about the manufacturer of a device based on its MAC address.

Types of Phishing Attacks

• Spear Phishing:
  Targets specific individuals or groups using personalized information (e.g., financial documents or current events) to increase credibility.
• Smishing:
  A phishing attack using fake SMS messages to trick users into downloading malware, sharing sensitive data, or sending money.
• Quishing:
  QR Code Phishing—users are tricked into scanning malicious QR codes that redirect to fake websites.
• Vishing:
  Voice Phishing—attackers impersonate legitimate entities over calls to extract sensitive information.

Incident Analysis

If an incident occurs, the IP address of a system can be tracked for up to 6 months, even if the IP address changes multiple times after the event.

Useful Tools and Websites for Information Gathering

1. DNS Searcher: For querying DNS records.
2. Advanced IP Scanner: Scans networks for connected devices and their details.
3. Netcraft: Provides information about websites, their hosting, and associated risks.
4. Archive.org: Access historical versions of websites via the Wayback Machine.