[{"data":1,"prerenderedAt":6547},["ShallowReactive",2],{"\u002Fblog\u002F2020\u002Fopen-source-intelligence":3,"\u002Fblog\u002F2020\u002Fopen-source-intelligence-surround":6536},{"id":4,"title":5,"author":6,"badge":11,"body":13,"date":6524,"description":6525,"draft":6526,"extension":6527,"image":6528,"meta":6530,"navigation":6531,"path":6532,"seo":6533,"stem":6534,"__hash__":6535},"posts\u002Fblog\u002F2020\u002Fopen-source-intelligence.md","Passive.. Passive Recon.. Passive Reconnaissance.. OSINT!",{"name":7,"to":8,"avatar":9},"Nir Galon","https:\u002F\u002Fx.com\u002Fnirgn975",{"src":10},"\u002Favatar.webp",{"label":12},"hacking",{"type":14,"value":15,"toc":6514},"minimark",[16,20,35,38,46,49,59,64,67,70,73,185,188,219,223,242,1060,1063,2384,2397,2436,2448,2451,2470,2473,4222,4225,4234,4247,4253,4259,4263,4272,4279,4292,4326,4329,4359,4368,4377,4386,4397,4412,4421,4439,4452,4455,4477,4486,4495,4499,4517,4526,4529,4538,4579,4596,4605,4614,4627,4634,4637,4664,4667,4671,4683,4879,4888,4897,4908,5041,5048,5061,5074,5354,5376,5398,5411,5418,5424,5428,5440,6141,6170,6178,6217,6233,6240,6253,6259,6270,6319,6328,6339,6346,6353,6359,6366,6373,6423,6452,6456,6459,6468,6475,6493,6500,6504,6507,6510],[17,18,19],"p",{},"Every operation need good intel, and good intel is hard to find. Or is it?",[17,21,22,29,30,34],{},[23,24,28],"a",{"href":25,"rel":26},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpen-source_intelligence",[27],"nofollow","OSINT (or Open Source Intelligence)"," is the operation of collecting and analyzing information about a target from various sources. A lot of times you'll see the terms \"public\" or \"open\" sources but let's be honest here, this is false and that's why I wrote ",[31,32,33],"em",{},"various sources",".",[17,36,37],{},"This is not to say that hacking to someone and steal his data is OSINT, because it's not. But not all the sources we'll use are public and open to everyone, and their data isn't collected by those services in an open way (innocently and \u002F or with user consent).",[17,39,40,41,45],{},"When talking about reconnaissance, the first step of red teams in an engagement (or 5 phases of ",[42,43,44],"span",{},"ethical"," hacking), people means passive reconnaissance. It's the attempt to gain information about a target (a human, a computer and \u002F or a network) without actively engaging with it.",[17,47,48],{},"In this post I want you to tag a long with me when I'm doing a reconnaissance. Maybe I will censor certain details but I'll talk about it all. There are a lot of tools to help us do it, and we'll use them, but none the less there is a lot of manual hard work (and drop of art) to be done.",[50,51,52],"blockquote",{},[17,53,54,58],{},[55,56,57],"strong",{},"Disclaimer:"," I'm not a professional pen tester. This is for educational purposes only.",[60,61,63],"h2",{"id":62},"_1-story-time","1. Story Time",[17,65,66],{},"At work I am responsible for a service that is mostly a backend service, but we have a small client (web interface) to help us manage things and see some analytics about our company's product. This interface have a login page where you need to enter a username and a password to get in, and you can't register to it, I need to give you access to it. This is an internal tool for the company.",[17,68,69],{},"So, naturally, I put some more security on that service. One of them was to log all logins to the system, and especially false attempts to login and an email notification to myself when that happens.",[17,71,72],{},"Everything was quiet for a long time, but we know it's not going to be like that forever. Lo and behold about a month ago it happened for the first time! Someone tried to penetrate the system with a non-existent username and password. I got 4 attempts, because I don't even let you have a third strike - I put your IP in a blacklist. So as you see in the table below we basically have 2 real attempts (2 IPs) with 4 different credentials.",[74,75,76,101],"table",{},[77,78,79],"thead",{},[80,81,82,86,89,92,95,98],"tr",{},[83,84,85],"th",{},"Email",[83,87,88],{},"Password",[83,90,91],{},"IP",[83,93,94],{},"Time",[83,96,97],{},"Accept Language",[83,99,100],{},"User Agent",[102,103,104,128,146,167],"tbody",{},[80,105,106,113,116,119,122,125],{},[107,108,109],"td",{},[23,110,112],{"href":111},"mailto:deion_kihn@bocah.team","deion_kihn@bocah.team",[107,114,115],{},"Harry1982!",[107,117,118],{},"84.17.46.157",[107,120,121],{},"2020-05-27T09:16:44.044Z",[107,123,124],{},"en-US",[107,126,127],{},"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36 (KHTML, like Gecko) Chrome\u002F67.0.3396.99 Safari\u002F537.36",[80,129,130,134,137,139,142,144],{},[107,131,132],{},[23,133,112],{"href":111},[107,135,136],{},"Harry1945",[107,138,118],{},[107,140,141],{},"2020-05-27T09:17:08.923Z",[107,143,124],{},[107,145,127],{},[80,147,148,154,157,160,163,165],{},[107,149,150],{},[23,151,153],{"href":152},"mailto:zena.durgan91@bocah.team","zena.durgan91@bocah.team",[107,155,156],{},"Isaac2007",[107,158,159],{},"154.127.57.238",[107,161,162],{},"2020-05-27T11:26:31.250Z",[107,164,124],{},[107,166,127],{},[80,168,169,173,176,178,181,183],{},[107,170,171],{},[23,172,153],{"href":152},[107,174,175],{},"Isaac1964!",[107,177,159],{},[107,179,180],{},"2020-05-27T11:26:55.474Z",[107,182,124],{},[107,184,127],{},[17,186,187],{},"We notice a bunch of things:",[189,190,191,195,198,201,212],"ul",{},[192,193,194],"li",{},"We have only 2 IPs.",[192,196,197],{},"The email address doesn't change in every attempt, only the password is changing in each attempt.",[192,199,200],{},"The two emails are with the same domain.",[192,202,203,204,207,208,211],{},"The language is always ",[205,206,124],"code",{}," which says nothing - this is by far the popular ",[205,209,210],{},"accept-language"," header on the internet.",[192,213,214,215,218],{},"The ",[205,216,217],{},"user agent"," is from Windows 10 with a Chrome web browser version 67 (the same exact version for all four attempts), which is pretty old version (and remember that chrome is automatically updated).",[60,220,222],{"id":221},"_2-lets-start-digging","2. Let's Start Digging",[17,224,225,226,228,229,231,232,235,236,241],{},"The easiest thing to look up first are the IPs and the domain. The first IP (",[205,227,118],{},") is from Netherlands, and the second (",[205,230,159],{},") is from the South Africa, here are the full ",[205,233,234],{},"JSON","s files I got from ",[23,237,240],{"href":238,"rel":239},"https:\u002F\u002Fipstack.com",[27],"ipstack",". I got the paid version of their API, but there is a free one and that's enough for our case here.",[243,244,250],"pre",{"className":245,"code":246,"filename":247,"language":248,"meta":249,"style":249},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"ip\": \"84.17.46.157\",\n  \"type\": \"ipv4\",\n  \"continent_code\": \"EU\",\n  \"continent_name\": \"Europe\",\n  \"country_code\": \"NL\",\n  \"country_name\": \"Netherlands\",\n  \"region_code\": \"NH\",\n  \"region_name\": \"North Holland\",\n  \"city\": \"Diemen\",\n  \"zip\": \"1101\",\n  \"latitude\": 52.309051513671875,\n  \"longitude\": 4.940189838409424,\n  \"location\": {\n    \"geoname_id\": 2756888,\n    \"capital\": \"Amsterdam\",\n    \"languages\": [\n      {\n        \"code\": \"nl\",\n        \"name\": \"Dutch\",\n        \"native\": \"Nederlands\"\n      }\n    ],\n    \"country_flag\": \"http:\u002F\u002Fassets.ipstack.com\u002Fflags\u002Fnl.svg\",\n    \"country_flag_emoji\": \"\\ud83c\\uddf3\\ud83c\\uddf1\",\n    \"country_flag_emoji_unicode\": \"U+1F1F3 U+1F1F1\",\n    \"calling_code\": \"31\",\n    \"is_eu\": true\n  },\n  \"time_zone\": {\n    \"id\": \"Europe\u002FAmsterdam\",\n    \"current_time\": \"2020-05-02T15:15:21+02:00\",\n    \"gmt_offset\": 7200,\n    \"code\": \"CEST\",\n    \"is_daylight_saving\": true\n  },\n  \"currency\": {\n    \"code\": \"EUR\",\n    \"name\": \"Euro\",\n    \"plural\": \"euros\",\n    \"symbol\": \"\\u20ac\",\n    \"symbol_native\": \"\\u20ac\"\n  },\n  \"connection\": {\n    \"asn\": 60068,\n    \"isp\": \"Datacamp Limited\"\n  }\n}\n","ipstack-1.json","json","",[205,251,252,260,287,308,329,350,371,392,413,434,455,476,494,511,526,545,566,581,587,608,629,649,655,661,682,704,725,746,761,767,781,802,823,840,860,874,879,893,913,933,954,975,993,998,1012,1029,1048,1054],{"__ignoreMap":249},[42,253,256],{"class":254,"line":255},"line",1,[42,257,259],{"class":258},"sMK4o","{\n",[42,261,263,266,270,273,276,279,282,284],{"class":254,"line":262},2,[42,264,265],{"class":258},"  \"",[42,267,269],{"class":268},"spNyl","ip",[42,271,272],{"class":258},"\"",[42,274,275],{"class":258},":",[42,277,278],{"class":258}," \"",[42,280,118],{"class":281},"sfazB",[42,283,272],{"class":258},[42,285,286],{"class":258},",\n",[42,288,290,292,295,297,299,301,304,306],{"class":254,"line":289},3,[42,291,265],{"class":258},[42,293,294],{"class":268},"type",[42,296,272],{"class":258},[42,298,275],{"class":258},[42,300,278],{"class":258},[42,302,303],{"class":281},"ipv4",[42,305,272],{"class":258},[42,307,286],{"class":258},[42,309,311,313,316,318,320,322,325,327],{"class":254,"line":310},4,[42,312,265],{"class":258},[42,314,315],{"class":268},"continent_code",[42,317,272],{"class":258},[42,319,275],{"class":258},[42,321,278],{"class":258},[42,323,324],{"class":281},"EU",[42,326,272],{"class":258},[42,328,286],{"class":258},[42,330,332,334,337,339,341,343,346,348],{"class":254,"line":331},5,[42,333,265],{"class":258},[42,335,336],{"class":268},"continent_name",[42,338,272],{"class":258},[42,340,275],{"class":258},[42,342,278],{"class":258},[42,344,345],{"class":281},"Europe",[42,347,272],{"class":258},[42,349,286],{"class":258},[42,351,353,355,358,360,362,364,367,369],{"class":254,"line":352},6,[42,354,265],{"class":258},[42,356,357],{"class":268},"country_code",[42,359,272],{"class":258},[42,361,275],{"class":258},[42,363,278],{"class":258},[42,365,366],{"class":281},"NL",[42,368,272],{"class":258},[42,370,286],{"class":258},[42,372,374,376,379,381,383,385,388,390],{"class":254,"line":373},7,[42,375,265],{"class":258},[42,377,378],{"class":268},"country_name",[42,380,272],{"class":258},[42,382,275],{"class":258},[42,384,278],{"class":258},[42,386,387],{"class":281},"Netherlands",[42,389,272],{"class":258},[42,391,286],{"class":258},[42,393,395,397,400,402,404,406,409,411],{"class":254,"line":394},8,[42,396,265],{"class":258},[42,398,399],{"class":268},"region_code",[42,401,272],{"class":258},[42,403,275],{"class":258},[42,405,278],{"class":258},[42,407,408],{"class":281},"NH",[42,410,272],{"class":258},[42,412,286],{"class":258},[42,414,416,418,421,423,425,427,430,432],{"class":254,"line":415},9,[42,417,265],{"class":258},[42,419,420],{"class":268},"region_name",[42,422,272],{"class":258},[42,424,275],{"class":258},[42,426,278],{"class":258},[42,428,429],{"class":281},"North Holland",[42,431,272],{"class":258},[42,433,286],{"class":258},[42,435,437,439,442,444,446,448,451,453],{"class":254,"line":436},10,[42,438,265],{"class":258},[42,440,441],{"class":268},"city",[42,443,272],{"class":258},[42,445,275],{"class":258},[42,447,278],{"class":258},[42,449,450],{"class":281},"Diemen",[42,452,272],{"class":258},[42,454,286],{"class":258},[42,456,458,460,463,465,467,469,472,474],{"class":254,"line":457},11,[42,459,265],{"class":258},[42,461,462],{"class":268},"zip",[42,464,272],{"class":258},[42,466,275],{"class":258},[42,468,278],{"class":258},[42,470,471],{"class":281},"1101",[42,473,272],{"class":258},[42,475,286],{"class":258},[42,477,479,481,484,486,488,492],{"class":254,"line":478},12,[42,480,265],{"class":258},[42,482,483],{"class":268},"latitude",[42,485,272],{"class":258},[42,487,275],{"class":258},[42,489,491],{"class":490},"sbssI"," 52.309051513671875",[42,493,286],{"class":258},[42,495,497,499,502,504,506,509],{"class":254,"line":496},13,[42,498,265],{"class":258},[42,500,501],{"class":268},"longitude",[42,503,272],{"class":258},[42,505,275],{"class":258},[42,507,508],{"class":490}," 4.940189838409424",[42,510,286],{"class":258},[42,512,514,516,519,521,523],{"class":254,"line":513},14,[42,515,265],{"class":258},[42,517,518],{"class":268},"location",[42,520,272],{"class":258},[42,522,275],{"class":258},[42,524,525],{"class":258}," {\n",[42,527,529,532,536,538,540,543],{"class":254,"line":528},15,[42,530,531],{"class":258},"    \"",[42,533,535],{"class":534},"sBMFI","geoname_id",[42,537,272],{"class":258},[42,539,275],{"class":258},[42,541,542],{"class":490}," 2756888",[42,544,286],{"class":258},[42,546,548,550,553,555,557,559,562,564],{"class":254,"line":547},16,[42,549,531],{"class":258},[42,551,552],{"class":534},"capital",[42,554,272],{"class":258},[42,556,275],{"class":258},[42,558,278],{"class":258},[42,560,561],{"class":281},"Amsterdam",[42,563,272],{"class":258},[42,565,286],{"class":258},[42,567,569,571,574,576,578],{"class":254,"line":568},17,[42,570,531],{"class":258},[42,572,573],{"class":534},"languages",[42,575,272],{"class":258},[42,577,275],{"class":258},[42,579,580],{"class":258}," [\n",[42,582,584],{"class":254,"line":583},18,[42,585,586],{"class":258},"      {\n",[42,588,590,593,595,597,599,601,604,606],{"class":254,"line":589},19,[42,591,592],{"class":258},"        \"",[42,594,205],{"class":490},[42,596,272],{"class":258},[42,598,275],{"class":258},[42,600,278],{"class":258},[42,602,603],{"class":281},"nl",[42,605,272],{"class":258},[42,607,286],{"class":258},[42,609,611,613,616,618,620,622,625,627],{"class":254,"line":610},20,[42,612,592],{"class":258},[42,614,615],{"class":490},"name",[42,617,272],{"class":258},[42,619,275],{"class":258},[42,621,278],{"class":258},[42,623,624],{"class":281},"Dutch",[42,626,272],{"class":258},[42,628,286],{"class":258},[42,630,632,634,637,639,641,643,646],{"class":254,"line":631},21,[42,633,592],{"class":258},[42,635,636],{"class":490},"native",[42,638,272],{"class":258},[42,640,275],{"class":258},[42,642,278],{"class":258},[42,644,645],{"class":281},"Nederlands",[42,647,648],{"class":258},"\"\n",[42,650,652],{"class":254,"line":651},22,[42,653,654],{"class":258},"      }\n",[42,656,658],{"class":254,"line":657},23,[42,659,660],{"class":258},"    ],\n",[42,662,664,666,669,671,673,675,678,680],{"class":254,"line":663},24,[42,665,531],{"class":258},[42,667,668],{"class":534},"country_flag",[42,670,272],{"class":258},[42,672,275],{"class":258},[42,674,278],{"class":258},[42,676,677],{"class":281},"http:\u002F\u002Fassets.ipstack.com\u002Fflags\u002Fnl.svg",[42,679,272],{"class":258},[42,681,286],{"class":258},[42,683,685,687,690,692,694,696,700,702],{"class":254,"line":684},25,[42,686,531],{"class":258},[42,688,689],{"class":534},"country_flag_emoji",[42,691,272],{"class":258},[42,693,275],{"class":258},[42,695,278],{"class":258},[42,697,699],{"class":698},"sTEyZ","\\ud83c\\uddf3\\ud83c\\uddf1",[42,701,272],{"class":258},[42,703,286],{"class":258},[42,705,707,709,712,714,716,718,721,723],{"class":254,"line":706},26,[42,708,531],{"class":258},[42,710,711],{"class":534},"country_flag_emoji_unicode",[42,713,272],{"class":258},[42,715,275],{"class":258},[42,717,278],{"class":258},[42,719,720],{"class":281},"U+1F1F3 U+1F1F1",[42,722,272],{"class":258},[42,724,286],{"class":258},[42,726,728,730,733,735,737,739,742,744],{"class":254,"line":727},27,[42,729,531],{"class":258},[42,731,732],{"class":534},"calling_code",[42,734,272],{"class":258},[42,736,275],{"class":258},[42,738,278],{"class":258},[42,740,741],{"class":281},"31",[42,743,272],{"class":258},[42,745,286],{"class":258},[42,747,749,751,754,756,758],{"class":254,"line":748},28,[42,750,531],{"class":258},[42,752,753],{"class":534},"is_eu",[42,755,272],{"class":258},[42,757,275],{"class":258},[42,759,760],{"class":258}," true\n",[42,762,764],{"class":254,"line":763},29,[42,765,766],{"class":258},"  },\n",[42,768,770,772,775,777,779],{"class":254,"line":769},30,[42,771,265],{"class":258},[42,773,774],{"class":268},"time_zone",[42,776,272],{"class":258},[42,778,275],{"class":258},[42,780,525],{"class":258},[42,782,784,786,789,791,793,795,798,800],{"class":254,"line":783},31,[42,785,531],{"class":258},[42,787,788],{"class":534},"id",[42,790,272],{"class":258},[42,792,275],{"class":258},[42,794,278],{"class":258},[42,796,797],{"class":281},"Europe\u002FAmsterdam",[42,799,272],{"class":258},[42,801,286],{"class":258},[42,803,805,807,810,812,814,816,819,821],{"class":254,"line":804},32,[42,806,531],{"class":258},[42,808,809],{"class":534},"current_time",[42,811,272],{"class":258},[42,813,275],{"class":258},[42,815,278],{"class":258},[42,817,818],{"class":281},"2020-05-02T15:15:21+02:00",[42,820,272],{"class":258},[42,822,286],{"class":258},[42,824,826,828,831,833,835,838],{"class":254,"line":825},33,[42,827,531],{"class":258},[42,829,830],{"class":534},"gmt_offset",[42,832,272],{"class":258},[42,834,275],{"class":258},[42,836,837],{"class":490}," 7200",[42,839,286],{"class":258},[42,841,843,845,847,849,851,853,856,858],{"class":254,"line":842},34,[42,844,531],{"class":258},[42,846,205],{"class":534},[42,848,272],{"class":258},[42,850,275],{"class":258},[42,852,278],{"class":258},[42,854,855],{"class":281},"CEST",[42,857,272],{"class":258},[42,859,286],{"class":258},[42,861,863,865,868,870,872],{"class":254,"line":862},35,[42,864,531],{"class":258},[42,866,867],{"class":534},"is_daylight_saving",[42,869,272],{"class":258},[42,871,275],{"class":258},[42,873,760],{"class":258},[42,875,877],{"class":254,"line":876},36,[42,878,766],{"class":258},[42,880,882,884,887,889,891],{"class":254,"line":881},37,[42,883,265],{"class":258},[42,885,886],{"class":268},"currency",[42,888,272],{"class":258},[42,890,275],{"class":258},[42,892,525],{"class":258},[42,894,896,898,900,902,904,906,909,911],{"class":254,"line":895},38,[42,897,531],{"class":258},[42,899,205],{"class":534},[42,901,272],{"class":258},[42,903,275],{"class":258},[42,905,278],{"class":258},[42,907,908],{"class":281},"EUR",[42,910,272],{"class":258},[42,912,286],{"class":258},[42,914,916,918,920,922,924,926,929,931],{"class":254,"line":915},39,[42,917,531],{"class":258},[42,919,615],{"class":534},[42,921,272],{"class":258},[42,923,275],{"class":258},[42,925,278],{"class":258},[42,927,928],{"class":281},"Euro",[42,930,272],{"class":258},[42,932,286],{"class":258},[42,934,936,938,941,943,945,947,950,952],{"class":254,"line":935},40,[42,937,531],{"class":258},[42,939,940],{"class":534},"plural",[42,942,272],{"class":258},[42,944,275],{"class":258},[42,946,278],{"class":258},[42,948,949],{"class":281},"euros",[42,951,272],{"class":258},[42,953,286],{"class":258},[42,955,957,959,962,964,966,968,971,973],{"class":254,"line":956},41,[42,958,531],{"class":258},[42,960,961],{"class":534},"symbol",[42,963,272],{"class":258},[42,965,275],{"class":258},[42,967,278],{"class":258},[42,969,970],{"class":698},"\\u20ac",[42,972,272],{"class":258},[42,974,286],{"class":258},[42,976,978,980,983,985,987,989,991],{"class":254,"line":977},42,[42,979,531],{"class":258},[42,981,982],{"class":534},"symbol_native",[42,984,272],{"class":258},[42,986,275],{"class":258},[42,988,278],{"class":258},[42,990,970],{"class":698},[42,992,648],{"class":258},[42,994,996],{"class":254,"line":995},43,[42,997,766],{"class":258},[42,999,1001,1003,1006,1008,1010],{"class":254,"line":1000},44,[42,1002,265],{"class":258},[42,1004,1005],{"class":268},"connection",[42,1007,272],{"class":258},[42,1009,275],{"class":258},[42,1011,525],{"class":258},[42,1013,1015,1017,1020,1022,1024,1027],{"class":254,"line":1014},45,[42,1016,531],{"class":258},[42,1018,1019],{"class":534},"asn",[42,1021,272],{"class":258},[42,1023,275],{"class":258},[42,1025,1026],{"class":490}," 60068",[42,1028,286],{"class":258},[42,1030,1032,1034,1037,1039,1041,1043,1046],{"class":254,"line":1031},46,[42,1033,531],{"class":258},[42,1035,1036],{"class":534},"isp",[42,1038,272],{"class":258},[42,1040,275],{"class":258},[42,1042,278],{"class":258},[42,1044,1045],{"class":281},"Datacamp Limited",[42,1047,648],{"class":258},[42,1049,1051],{"class":254,"line":1050},47,[42,1052,1053],{"class":258},"  }\n",[42,1055,1057],{"class":254,"line":1056},48,[42,1058,1059],{"class":258},"}\n",[17,1061,1062],{},"and",[243,1064,1067],{"className":245,"code":1065,"filename":1066,"language":248,"meta":249,"style":249},"{\n  \"ip\": \"154.127.57.238\",\n  \"type\": \"ipv4\",\n  \"continent_code\": \"AF\",\n  \"continent_name\": \"Africa\",\n  \"country_code\": \"ZA\",\n  \"country_name\": \"South Africa\",\n  \"region_code\": \"GT\",\n  \"region_name\": \"Gauteng\",\n  \"city\": \"Johannesburg\",\n  \"zip\": \"2000\",\n  \"latitude\": -26.199169158935547,\n  \"longitude\": 28.0563907623291,\n  \"location\": {\n    \"geoname_id\": 993800,\n    \"capital\": \"Pretoria\",\n    \"languages\": [\n      {\n        \"code\": \"af\",\n        \"name\": \"Afrikaans\",\n        \"native\": \"Afrikaans\"\n      },\n      {\n        \"code\": \"en\",\n        \"name\": \"English\",\n        \"native\": \"English\"\n      },\n      {\n        \"code\": \"nr\",\n        \"name\": \"South Ndebele\",\n        \"native\": \"isiNdebele\"\n      },\n      {\n        \"code\": \"st\",\n        \"name\": \"Southern Sotho\",\n        \"native\": \"Sesotho\"\n      },\n      {\n        \"code\": \"ss\",\n        \"name\": \"Swati\",\n        \"native\": \"SiSwati\"\n      },\n      {\n        \"code\": \"tn\",\n        \"name\": \"Tswana\",\n        \"native\": \"Setswana\"\n      },\n      {\n        \"code\": \"ts\",\n        \"name\": \"Tsonga\",\n        \"native\": \"Xitsonga\"\n      },\n      {\n        \"code\": \"ve\",\n        \"name\": \"Venda\",\n        \"native\": \"Tshiven\\u1e13a\"\n      },\n      {\n        \"code\": \"xh\",\n        \"name\": \"Xhosa\",\n        \"native\": \"isiXhosa\"\n      },\n      {\n        \"code\": \"zu\",\n        \"name\": \"Zulu\",\n        \"native\": \"isiZulu\"\n      }\n    ],\n    \"country_flag\": \"http:\u002F\u002Fassets.ipstack.com\u002Fflags\u002Fza.svg\",\n    \"country_flag_emoji\": \"\\ud83c\\uddff\\ud83c\\udde6\",\n    \"country_flag_emoji_unicode\": \"U+1F1FF U+1F1E6\",\n    \"calling_code\": \"27\",\n    \"is_eu\": false\n  },\n  \"time_zone\": {\n    \"id\": \"Africa\u002FJohannesburg\",\n    \"current_time\": \"2020-05-02T15:20:17+02:00\",\n    \"gmt_offset\": 7200,\n    \"code\": \"SAST\",\n    \"is_daylight_saving\": false\n  },\n  \"currency\": {\n    \"code\": \"ZAR\",\n    \"name\": \"South African Rand\",\n    \"plural\": \"South African rand\",\n    \"symbol\": \"R\",\n    \"symbol_native\": \"R\"\n  },\n  \"connection\": {\n    \"asn\": 61317,\n    \"isp\": \"Digital Energy Technologies Ltd.\"\n  }\n}\n","ip-stack2.json",[205,1068,1069,1073,1091,1109,1128,1147,1166,1185,1204,1223,1242,1261,1276,1291,1303,1318,1337,1349,1353,1372,1391,1407,1412,1416,1435,1454,1470,1474,1478,1497,1516,1533,1537,1541,1560,1579,1596,1600,1604,1623,1642,1659,1663,1667,1686,1705,1722,1726,1730,1750,1770,1788,1793,1798,1818,1838,1861,1866,1871,1891,1911,1929,1934,1939,1959,1979,1997,2002,2007,2027,2047,2067,2087,2101,2106,2119,2139,2159,2174,2194,2207,2212,2225,2245,2265,2285,2305,2322,2327,2340,2356,2374,2379],{"__ignoreMap":249},[42,1070,1071],{"class":254,"line":255},[42,1072,259],{"class":258},[42,1074,1075,1077,1079,1081,1083,1085,1087,1089],{"class":254,"line":262},[42,1076,265],{"class":258},[42,1078,269],{"class":268},[42,1080,272],{"class":258},[42,1082,275],{"class":258},[42,1084,278],{"class":258},[42,1086,159],{"class":281},[42,1088,272],{"class":258},[42,1090,286],{"class":258},[42,1092,1093,1095,1097,1099,1101,1103,1105,1107],{"class":254,"line":289},[42,1094,265],{"class":258},[42,1096,294],{"class":268},[42,1098,272],{"class":258},[42,1100,275],{"class":258},[42,1102,278],{"class":258},[42,1104,303],{"class":281},[42,1106,272],{"class":258},[42,1108,286],{"class":258},[42,1110,1111,1113,1115,1117,1119,1121,1124,1126],{"class":254,"line":310},[42,1112,265],{"class":258},[42,1114,315],{"class":268},[42,1116,272],{"class":258},[42,1118,275],{"class":258},[42,1120,278],{"class":258},[42,1122,1123],{"class":281},"AF",[42,1125,272],{"class":258},[42,1127,286],{"class":258},[42,1129,1130,1132,1134,1136,1138,1140,1143,1145],{"class":254,"line":331},[42,1131,265],{"class":258},[42,1133,336],{"class":268},[42,1135,272],{"class":258},[42,1137,275],{"class":258},[42,1139,278],{"class":258},[42,1141,1142],{"class":281},"Africa",[42,1144,272],{"class":258},[42,1146,286],{"class":258},[42,1148,1149,1151,1153,1155,1157,1159,1162,1164],{"class":254,"line":352},[42,1150,265],{"class":258},[42,1152,357],{"class":268},[42,1154,272],{"class":258},[42,1156,275],{"class":258},[42,1158,278],{"class":258},[42,1160,1161],{"class":281},"ZA",[42,1163,272],{"class":258},[42,1165,286],{"class":258},[42,1167,1168,1170,1172,1174,1176,1178,1181,1183],{"class":254,"line":373},[42,1169,265],{"class":258},[42,1171,378],{"class":268},[42,1173,272],{"class":258},[42,1175,275],{"class":258},[42,1177,278],{"class":258},[42,1179,1180],{"class":281},"South Africa",[42,1182,272],{"class":258},[42,1184,286],{"class":258},[42,1186,1187,1189,1191,1193,1195,1197,1200,1202],{"class":254,"line":394},[42,1188,265],{"class":258},[42,1190,399],{"class":268},[42,1192,272],{"class":258},[42,1194,275],{"class":258},[42,1196,278],{"class":258},[42,1198,1199],{"class":281},"GT",[42,1201,272],{"class":258},[42,1203,286],{"class":258},[42,1205,1206,1208,1210,1212,1214,1216,1219,1221],{"class":254,"line":415},[42,1207,265],{"class":258},[42,1209,420],{"class":268},[42,1211,272],{"class":258},[42,1213,275],{"class":258},[42,1215,278],{"class":258},[42,1217,1218],{"class":281},"Gauteng",[42,1220,272],{"class":258},[42,1222,286],{"class":258},[42,1224,1225,1227,1229,1231,1233,1235,1238,1240],{"class":254,"line":436},[42,1226,265],{"class":258},[42,1228,441],{"class":268},[42,1230,272],{"class":258},[42,1232,275],{"class":258},[42,1234,278],{"class":258},[42,1236,1237],{"class":281},"Johannesburg",[42,1239,272],{"class":258},[42,1241,286],{"class":258},[42,1243,1244,1246,1248,1250,1252,1254,1257,1259],{"class":254,"line":457},[42,1245,265],{"class":258},[42,1247,462],{"class":268},[42,1249,272],{"class":258},[42,1251,275],{"class":258},[42,1253,278],{"class":258},[42,1255,1256],{"class":281},"2000",[42,1258,272],{"class":258},[42,1260,286],{"class":258},[42,1262,1263,1265,1267,1269,1271,1274],{"class":254,"line":478},[42,1264,265],{"class":258},[42,1266,483],{"class":268},[42,1268,272],{"class":258},[42,1270,275],{"class":258},[42,1272,1273],{"class":490}," -26.199169158935547",[42,1275,286],{"class":258},[42,1277,1278,1280,1282,1284,1286,1289],{"class":254,"line":496},[42,1279,265],{"class":258},[42,1281,501],{"class":268},[42,1283,272],{"class":258},[42,1285,275],{"class":258},[42,1287,1288],{"class":490}," 28.0563907623291",[42,1290,286],{"class":258},[42,1292,1293,1295,1297,1299,1301],{"class":254,"line":513},[42,1294,265],{"class":258},[42,1296,518],{"class":268},[42,1298,272],{"class":258},[42,1300,275],{"class":258},[42,1302,525],{"class":258},[42,1304,1305,1307,1309,1311,1313,1316],{"class":254,"line":528},[42,1306,531],{"class":258},[42,1308,535],{"class":534},[42,1310,272],{"class":258},[42,1312,275],{"class":258},[42,1314,1315],{"class":490}," 993800",[42,1317,286],{"class":258},[42,1319,1320,1322,1324,1326,1328,1330,1333,1335],{"class":254,"line":547},[42,1321,531],{"class":258},[42,1323,552],{"class":534},[42,1325,272],{"class":258},[42,1327,275],{"class":258},[42,1329,278],{"class":258},[42,1331,1332],{"class":281},"Pretoria",[42,1334,272],{"class":258},[42,1336,286],{"class":258},[42,1338,1339,1341,1343,1345,1347],{"class":254,"line":568},[42,1340,531],{"class":258},[42,1342,573],{"class":534},[42,1344,272],{"class":258},[42,1346,275],{"class":258},[42,1348,580],{"class":258},[42,1350,1351],{"class":254,"line":583},[42,1352,586],{"class":258},[42,1354,1355,1357,1359,1361,1363,1365,1368,1370],{"class":254,"line":589},[42,1356,592],{"class":258},[42,1358,205],{"class":490},[42,1360,272],{"class":258},[42,1362,275],{"class":258},[42,1364,278],{"class":258},[42,1366,1367],{"class":281},"af",[42,1369,272],{"class":258},[42,1371,286],{"class":258},[42,1373,1374,1376,1378,1380,1382,1384,1387,1389],{"class":254,"line":610},[42,1375,592],{"class":258},[42,1377,615],{"class":490},[42,1379,272],{"class":258},[42,1381,275],{"class":258},[42,1383,278],{"class":258},[42,1385,1386],{"class":281},"Afrikaans",[42,1388,272],{"class":258},[42,1390,286],{"class":258},[42,1392,1393,1395,1397,1399,1401,1403,1405],{"class":254,"line":631},[42,1394,592],{"class":258},[42,1396,636],{"class":490},[42,1398,272],{"class":258},[42,1400,275],{"class":258},[42,1402,278],{"class":258},[42,1404,1386],{"class":281},[42,1406,648],{"class":258},[42,1408,1409],{"class":254,"line":651},[42,1410,1411],{"class":258},"      },\n",[42,1413,1414],{"class":254,"line":657},[42,1415,586],{"class":258},[42,1417,1418,1420,1422,1424,1426,1428,1431,1433],{"class":254,"line":663},[42,1419,592],{"class":258},[42,1421,205],{"class":490},[42,1423,272],{"class":258},[42,1425,275],{"class":258},[42,1427,278],{"class":258},[42,1429,1430],{"class":281},"en",[42,1432,272],{"class":258},[42,1434,286],{"class":258},[42,1436,1437,1439,1441,1443,1445,1447,1450,1452],{"class":254,"line":684},[42,1438,592],{"class":258},[42,1440,615],{"class":490},[42,1442,272],{"class":258},[42,1444,275],{"class":258},[42,1446,278],{"class":258},[42,1448,1449],{"class":281},"English",[42,1451,272],{"class":258},[42,1453,286],{"class":258},[42,1455,1456,1458,1460,1462,1464,1466,1468],{"class":254,"line":706},[42,1457,592],{"class":258},[42,1459,636],{"class":490},[42,1461,272],{"class":258},[42,1463,275],{"class":258},[42,1465,278],{"class":258},[42,1467,1449],{"class":281},[42,1469,648],{"class":258},[42,1471,1472],{"class":254,"line":727},[42,1473,1411],{"class":258},[42,1475,1476],{"class":254,"line":748},[42,1477,586],{"class":258},[42,1479,1480,1482,1484,1486,1488,1490,1493,1495],{"class":254,"line":763},[42,1481,592],{"class":258},[42,1483,205],{"class":490},[42,1485,272],{"class":258},[42,1487,275],{"class":258},[42,1489,278],{"class":258},[42,1491,1492],{"class":281},"nr",[42,1494,272],{"class":258},[42,1496,286],{"class":258},[42,1498,1499,1501,1503,1505,1507,1509,1512,1514],{"class":254,"line":769},[42,1500,592],{"class":258},[42,1502,615],{"class":490},[42,1504,272],{"class":258},[42,1506,275],{"class":258},[42,1508,278],{"class":258},[42,1510,1511],{"class":281},"South Ndebele",[42,1513,272],{"class":258},[42,1515,286],{"class":258},[42,1517,1518,1520,1522,1524,1526,1528,1531],{"class":254,"line":783},[42,1519,592],{"class":258},[42,1521,636],{"class":490},[42,1523,272],{"class":258},[42,1525,275],{"class":258},[42,1527,278],{"class":258},[42,1529,1530],{"class":281},"isiNdebele",[42,1532,648],{"class":258},[42,1534,1535],{"class":254,"line":804},[42,1536,1411],{"class":258},[42,1538,1539],{"class":254,"line":825},[42,1540,586],{"class":258},[42,1542,1543,1545,1547,1549,1551,1553,1556,1558],{"class":254,"line":842},[42,1544,592],{"class":258},[42,1546,205],{"class":490},[42,1548,272],{"class":258},[42,1550,275],{"class":258},[42,1552,278],{"class":258},[42,1554,1555],{"class":281},"st",[42,1557,272],{"class":258},[42,1559,286],{"class":258},[42,1561,1562,1564,1566,1568,1570,1572,1575,1577],{"class":254,"line":862},[42,1563,592],{"class":258},[42,1565,615],{"class":490},[42,1567,272],{"class":258},[42,1569,275],{"class":258},[42,1571,278],{"class":258},[42,1573,1574],{"class":281},"Southern Sotho",[42,1576,272],{"class":258},[42,1578,286],{"class":258},[42,1580,1581,1583,1585,1587,1589,1591,1594],{"class":254,"line":876},[42,1582,592],{"class":258},[42,1584,636],{"class":490},[42,1586,272],{"class":258},[42,1588,275],{"class":258},[42,1590,278],{"class":258},[42,1592,1593],{"class":281},"Sesotho",[42,1595,648],{"class":258},[42,1597,1598],{"class":254,"line":881},[42,1599,1411],{"class":258},[42,1601,1602],{"class":254,"line":895},[42,1603,586],{"class":258},[42,1605,1606,1608,1610,1612,1614,1616,1619,1621],{"class":254,"line":915},[42,1607,592],{"class":258},[42,1609,205],{"class":490},[42,1611,272],{"class":258},[42,1613,275],{"class":258},[42,1615,278],{"class":258},[42,1617,1618],{"class":281},"ss",[42,1620,272],{"class":258},[42,1622,286],{"class":258},[42,1624,1625,1627,1629,1631,1633,1635,1638,1640],{"class":254,"line":935},[42,1626,592],{"class":258},[42,1628,615],{"class":490},[42,1630,272],{"class":258},[42,1632,275],{"class":258},[42,1634,278],{"class":258},[42,1636,1637],{"class":281},"Swati",[42,1639,272],{"class":258},[42,1641,286],{"class":258},[42,1643,1644,1646,1648,1650,1652,1654,1657],{"class":254,"line":956},[42,1645,592],{"class":258},[42,1647,636],{"class":490},[42,1649,272],{"class":258},[42,1651,275],{"class":258},[42,1653,278],{"class":258},[42,1655,1656],{"class":281},"SiSwati",[42,1658,648],{"class":258},[42,1660,1661],{"class":254,"line":977},[42,1662,1411],{"class":258},[42,1664,1665],{"class":254,"line":995},[42,1666,586],{"class":258},[42,1668,1669,1671,1673,1675,1677,1679,1682,1684],{"class":254,"line":1000},[42,1670,592],{"class":258},[42,1672,205],{"class":490},[42,1674,272],{"class":258},[42,1676,275],{"class":258},[42,1678,278],{"class":258},[42,1680,1681],{"class":281},"tn",[42,1683,272],{"class":258},[42,1685,286],{"class":258},[42,1687,1688,1690,1692,1694,1696,1698,1701,1703],{"class":254,"line":1014},[42,1689,592],{"class":258},[42,1691,615],{"class":490},[42,1693,272],{"class":258},[42,1695,275],{"class":258},[42,1697,278],{"class":258},[42,1699,1700],{"class":281},"Tswana",[42,1702,272],{"class":258},[42,1704,286],{"class":258},[42,1706,1707,1709,1711,1713,1715,1717,1720],{"class":254,"line":1031},[42,1708,592],{"class":258},[42,1710,636],{"class":490},[42,1712,272],{"class":258},[42,1714,275],{"class":258},[42,1716,278],{"class":258},[42,1718,1719],{"class":281},"Setswana",[42,1721,648],{"class":258},[42,1723,1724],{"class":254,"line":1050},[42,1725,1411],{"class":258},[42,1727,1728],{"class":254,"line":1056},[42,1729,586],{"class":258},[42,1731,1733,1735,1737,1739,1741,1743,1746,1748],{"class":254,"line":1732},49,[42,1734,592],{"class":258},[42,1736,205],{"class":490},[42,1738,272],{"class":258},[42,1740,275],{"class":258},[42,1742,278],{"class":258},[42,1744,1745],{"class":281},"ts",[42,1747,272],{"class":258},[42,1749,286],{"class":258},[42,1751,1753,1755,1757,1759,1761,1763,1766,1768],{"class":254,"line":1752},50,[42,1754,592],{"class":258},[42,1756,615],{"class":490},[42,1758,272],{"class":258},[42,1760,275],{"class":258},[42,1762,278],{"class":258},[42,1764,1765],{"class":281},"Tsonga",[42,1767,272],{"class":258},[42,1769,286],{"class":258},[42,1771,1773,1775,1777,1779,1781,1783,1786],{"class":254,"line":1772},51,[42,1774,592],{"class":258},[42,1776,636],{"class":490},[42,1778,272],{"class":258},[42,1780,275],{"class":258},[42,1782,278],{"class":258},[42,1784,1785],{"class":281},"Xitsonga",[42,1787,648],{"class":258},[42,1789,1791],{"class":254,"line":1790},52,[42,1792,1411],{"class":258},[42,1794,1796],{"class":254,"line":1795},53,[42,1797,586],{"class":258},[42,1799,1801,1803,1805,1807,1809,1811,1814,1816],{"class":254,"line":1800},54,[42,1802,592],{"class":258},[42,1804,205],{"class":490},[42,1806,272],{"class":258},[42,1808,275],{"class":258},[42,1810,278],{"class":258},[42,1812,1813],{"class":281},"ve",[42,1815,272],{"class":258},[42,1817,286],{"class":258},[42,1819,1821,1823,1825,1827,1829,1831,1834,1836],{"class":254,"line":1820},55,[42,1822,592],{"class":258},[42,1824,615],{"class":490},[42,1826,272],{"class":258},[42,1828,275],{"class":258},[42,1830,278],{"class":258},[42,1832,1833],{"class":281},"Venda",[42,1835,272],{"class":258},[42,1837,286],{"class":258},[42,1839,1841,1843,1845,1847,1849,1851,1854,1857,1859],{"class":254,"line":1840},56,[42,1842,592],{"class":258},[42,1844,636],{"class":490},[42,1846,272],{"class":258},[42,1848,275],{"class":258},[42,1850,278],{"class":258},[42,1852,1853],{"class":281},"Tshiven",[42,1855,1856],{"class":698},"\\u1e13",[42,1858,23],{"class":281},[42,1860,648],{"class":258},[42,1862,1864],{"class":254,"line":1863},57,[42,1865,1411],{"class":258},[42,1867,1869],{"class":254,"line":1868},58,[42,1870,586],{"class":258},[42,1872,1874,1876,1878,1880,1882,1884,1887,1889],{"class":254,"line":1873},59,[42,1875,592],{"class":258},[42,1877,205],{"class":490},[42,1879,272],{"class":258},[42,1881,275],{"class":258},[42,1883,278],{"class":258},[42,1885,1886],{"class":281},"xh",[42,1888,272],{"class":258},[42,1890,286],{"class":258},[42,1892,1894,1896,1898,1900,1902,1904,1907,1909],{"class":254,"line":1893},60,[42,1895,592],{"class":258},[42,1897,615],{"class":490},[42,1899,272],{"class":258},[42,1901,275],{"class":258},[42,1903,278],{"class":258},[42,1905,1906],{"class":281},"Xhosa",[42,1908,272],{"class":258},[42,1910,286],{"class":258},[42,1912,1914,1916,1918,1920,1922,1924,1927],{"class":254,"line":1913},61,[42,1915,592],{"class":258},[42,1917,636],{"class":490},[42,1919,272],{"class":258},[42,1921,275],{"class":258},[42,1923,278],{"class":258},[42,1925,1926],{"class":281},"isiXhosa",[42,1928,648],{"class":258},[42,1930,1932],{"class":254,"line":1931},62,[42,1933,1411],{"class":258},[42,1935,1937],{"class":254,"line":1936},63,[42,1938,586],{"class":258},[42,1940,1942,1944,1946,1948,1950,1952,1955,1957],{"class":254,"line":1941},64,[42,1943,592],{"class":258},[42,1945,205],{"class":490},[42,1947,272],{"class":258},[42,1949,275],{"class":258},[42,1951,278],{"class":258},[42,1953,1954],{"class":281},"zu",[42,1956,272],{"class":258},[42,1958,286],{"class":258},[42,1960,1962,1964,1966,1968,1970,1972,1975,1977],{"class":254,"line":1961},65,[42,1963,592],{"class":258},[42,1965,615],{"class":490},[42,1967,272],{"class":258},[42,1969,275],{"class":258},[42,1971,278],{"class":258},[42,1973,1974],{"class":281},"Zulu",[42,1976,272],{"class":258},[42,1978,286],{"class":258},[42,1980,1982,1984,1986,1988,1990,1992,1995],{"class":254,"line":1981},66,[42,1983,592],{"class":258},[42,1985,636],{"class":490},[42,1987,272],{"class":258},[42,1989,275],{"class":258},[42,1991,278],{"class":258},[42,1993,1994],{"class":281},"isiZulu",[42,1996,648],{"class":258},[42,1998,2000],{"class":254,"line":1999},67,[42,2001,654],{"class":258},[42,2003,2005],{"class":254,"line":2004},68,[42,2006,660],{"class":258},[42,2008,2010,2012,2014,2016,2018,2020,2023,2025],{"class":254,"line":2009},69,[42,2011,531],{"class":258},[42,2013,668],{"class":534},[42,2015,272],{"class":258},[42,2017,275],{"class":258},[42,2019,278],{"class":258},[42,2021,2022],{"class":281},"http:\u002F\u002Fassets.ipstack.com\u002Fflags\u002Fza.svg",[42,2024,272],{"class":258},[42,2026,286],{"class":258},[42,2028,2030,2032,2034,2036,2038,2040,2043,2045],{"class":254,"line":2029},70,[42,2031,531],{"class":258},[42,2033,689],{"class":534},[42,2035,272],{"class":258},[42,2037,275],{"class":258},[42,2039,278],{"class":258},[42,2041,2042],{"class":698},"\\ud83c\\uddff\\ud83c\\udde6",[42,2044,272],{"class":258},[42,2046,286],{"class":258},[42,2048,2050,2052,2054,2056,2058,2060,2063,2065],{"class":254,"line":2049},71,[42,2051,531],{"class":258},[42,2053,711],{"class":534},[42,2055,272],{"class":258},[42,2057,275],{"class":258},[42,2059,278],{"class":258},[42,2061,2062],{"class":281},"U+1F1FF U+1F1E6",[42,2064,272],{"class":258},[42,2066,286],{"class":258},[42,2068,2070,2072,2074,2076,2078,2080,2083,2085],{"class":254,"line":2069},72,[42,2071,531],{"class":258},[42,2073,732],{"class":534},[42,2075,272],{"class":258},[42,2077,275],{"class":258},[42,2079,278],{"class":258},[42,2081,2082],{"class":281},"27",[42,2084,272],{"class":258},[42,2086,286],{"class":258},[42,2088,2090,2092,2094,2096,2098],{"class":254,"line":2089},73,[42,2091,531],{"class":258},[42,2093,753],{"class":534},[42,2095,272],{"class":258},[42,2097,275],{"class":258},[42,2099,2100],{"class":258}," false\n",[42,2102,2104],{"class":254,"line":2103},74,[42,2105,766],{"class":258},[42,2107,2109,2111,2113,2115,2117],{"class":254,"line":2108},75,[42,2110,265],{"class":258},[42,2112,774],{"class":268},[42,2114,272],{"class":258},[42,2116,275],{"class":258},[42,2118,525],{"class":258},[42,2120,2122,2124,2126,2128,2130,2132,2135,2137],{"class":254,"line":2121},76,[42,2123,531],{"class":258},[42,2125,788],{"class":534},[42,2127,272],{"class":258},[42,2129,275],{"class":258},[42,2131,278],{"class":258},[42,2133,2134],{"class":281},"Africa\u002FJohannesburg",[42,2136,272],{"class":258},[42,2138,286],{"class":258},[42,2140,2142,2144,2146,2148,2150,2152,2155,2157],{"class":254,"line":2141},77,[42,2143,531],{"class":258},[42,2145,809],{"class":534},[42,2147,272],{"class":258},[42,2149,275],{"class":258},[42,2151,278],{"class":258},[42,2153,2154],{"class":281},"2020-05-02T15:20:17+02:00",[42,2156,272],{"class":258},[42,2158,286],{"class":258},[42,2160,2162,2164,2166,2168,2170,2172],{"class":254,"line":2161},78,[42,2163,531],{"class":258},[42,2165,830],{"class":534},[42,2167,272],{"class":258},[42,2169,275],{"class":258},[42,2171,837],{"class":490},[42,2173,286],{"class":258},[42,2175,2177,2179,2181,2183,2185,2187,2190,2192],{"class":254,"line":2176},79,[42,2178,531],{"class":258},[42,2180,205],{"class":534},[42,2182,272],{"class":258},[42,2184,275],{"class":258},[42,2186,278],{"class":258},[42,2188,2189],{"class":281},"SAST",[42,2191,272],{"class":258},[42,2193,286],{"class":258},[42,2195,2197,2199,2201,2203,2205],{"class":254,"line":2196},80,[42,2198,531],{"class":258},[42,2200,867],{"class":534},[42,2202,272],{"class":258},[42,2204,275],{"class":258},[42,2206,2100],{"class":258},[42,2208,2210],{"class":254,"line":2209},81,[42,2211,766],{"class":258},[42,2213,2215,2217,2219,2221,2223],{"class":254,"line":2214},82,[42,2216,265],{"class":258},[42,2218,886],{"class":268},[42,2220,272],{"class":258},[42,2222,275],{"class":258},[42,2224,525],{"class":258},[42,2226,2228,2230,2232,2234,2236,2238,2241,2243],{"class":254,"line":2227},83,[42,2229,531],{"class":258},[42,2231,205],{"class":534},[42,2233,272],{"class":258},[42,2235,275],{"class":258},[42,2237,278],{"class":258},[42,2239,2240],{"class":281},"ZAR",[42,2242,272],{"class":258},[42,2244,286],{"class":258},[42,2246,2248,2250,2252,2254,2256,2258,2261,2263],{"class":254,"line":2247},84,[42,2249,531],{"class":258},[42,2251,615],{"class":534},[42,2253,272],{"class":258},[42,2255,275],{"class":258},[42,2257,278],{"class":258},[42,2259,2260],{"class":281},"South African Rand",[42,2262,272],{"class":258},[42,2264,286],{"class":258},[42,2266,2268,2270,2272,2274,2276,2278,2281,2283],{"class":254,"line":2267},85,[42,2269,531],{"class":258},[42,2271,940],{"class":534},[42,2273,272],{"class":258},[42,2275,275],{"class":258},[42,2277,278],{"class":258},[42,2279,2280],{"class":281},"South African rand",[42,2282,272],{"class":258},[42,2284,286],{"class":258},[42,2286,2288,2290,2292,2294,2296,2298,2301,2303],{"class":254,"line":2287},86,[42,2289,531],{"class":258},[42,2291,961],{"class":534},[42,2293,272],{"class":258},[42,2295,275],{"class":258},[42,2297,278],{"class":258},[42,2299,2300],{"class":281},"R",[42,2302,272],{"class":258},[42,2304,286],{"class":258},[42,2306,2308,2310,2312,2314,2316,2318,2320],{"class":254,"line":2307},87,[42,2309,531],{"class":258},[42,2311,982],{"class":534},[42,2313,272],{"class":258},[42,2315,275],{"class":258},[42,2317,278],{"class":258},[42,2319,2300],{"class":281},[42,2321,648],{"class":258},[42,2323,2325],{"class":254,"line":2324},88,[42,2326,766],{"class":258},[42,2328,2330,2332,2334,2336,2338],{"class":254,"line":2329},89,[42,2331,265],{"class":258},[42,2333,1005],{"class":268},[42,2335,272],{"class":258},[42,2337,275],{"class":258},[42,2339,525],{"class":258},[42,2341,2343,2345,2347,2349,2351,2354],{"class":254,"line":2342},90,[42,2344,531],{"class":258},[42,2346,1019],{"class":534},[42,2348,272],{"class":258},[42,2350,275],{"class":258},[42,2352,2353],{"class":490}," 61317",[42,2355,286],{"class":258},[42,2357,2359,2361,2363,2365,2367,2369,2372],{"class":254,"line":2358},91,[42,2360,531],{"class":258},[42,2362,1036],{"class":534},[42,2364,272],{"class":258},[42,2366,275],{"class":258},[42,2368,278],{"class":258},[42,2370,2371],{"class":281},"Digital Energy Technologies Ltd.",[42,2373,648],{"class":258},[42,2375,2377],{"class":254,"line":2376},92,[42,2378,1053],{"class":258},[42,2380,2382],{"class":254,"line":2381},93,[42,2383,1059],{"class":258},[17,2385,2386,2387,2392,2393,2396],{},"This looks like a dead end for now, let's check the domain. For that I use ",[23,2388,2391],{"href":2389,"rel":2390},"http:\u002F\u002Fdomaintools.com",[27],"DomainTools",", they have a pretty nice and free service for Whois lookup. So when I searched ",[205,2394,2395],{},"bocah.team"," I didn't get much, it looks like the domain has privacy protection, this means we cannot see who bought it.",[17,2398,2399,2400,2405,2406,2411,2412,2417,2418,2421,2422,2425,2426,2431,2432,2435],{},"But we can see a lot of other stuff, like it's registered by ",[23,2401,2404],{"href":2402,"rel":2403},"https:\u002F\u002Fwww.namecheap.com",[27],"NameCheap"," and protected by ",[23,2407,2410],{"href":2408,"rel":2409},"http:\u002F\u002Fwww.whoisguard.com\u002F",[27],"WhoisGuard",". It was created on 2018-07-13. The server the domain points to is a ",[23,2413,2416],{"href":2414,"rel":2415},"https:\u002F\u002Fwww.digitalocean.com",[27],"DigitalOcean"," one in the United Kingdom and his IP is ",[205,2419,2420],{},"188.166.152.221",". They got ",[205,2423,2424],{},"200"," status code back from an ",[23,2427,2430],{"href":2428,"rel":2429},"https:\u002F\u002Fwww.apache.org",[27],"Apache Web Server",", and it tells us there are ",[31,2433,2434],{},"257 other sites hosted on this server","! So it's time to do a reverse IP lookup for this server IP.",[17,2437,2438],{},[2439,2440],"img",{"alt":2441,"className":2442,"src":2445,"height":2446,"width":2447},"DomainTools Whois Report",[2443,2444],"rounded-lg","mx-auto","\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fdomain-tools-whois-report.webp",785,767,[17,2449,2450],{},"DomainTools don't let you do a reverse IP lookup for free, they'll show you couple of results and if you want to see more you need to buy a membership. We're amateurs here, I don't intend to throw away $99 per month for one reverse IP lookup, let's find another service.",[17,2452,2453,2454,2459,2460,2465,2466,2469],{},"Actually there are quite a few that does that for free, like ",[23,2455,2458],{"href":2456,"rel":2457},"https:\u002F\u002Fhackertarget.com",[27],"Hacker Target",", and ",[23,2461,2464],{"href":2462,"rel":2463},"https:\u002F\u002Fviewdns.info\u002F",[27],"ViewDNS",". I especially love ViewDNS because it gives you the dates of ",[31,2467,2468],{},"Last Resolved"," for every domain, and gives you a total number at the top (so you can match its findings with other services).",[17,2471,2472],{},"ViewDNS found 242 domains, almost everything that DomainTools said there are, and it's quite the list.",[2474,2475,2476,2477,2481],"details",{},"\n  ",[2478,2479,2480],"summary",{},"Click here to see the 242 domains table.",[74,2482,2483,2493],{},[77,2484,2485],{},[80,2486,2487,2490],{},[83,2488,2489],{},"Domain",[83,2491,2492],{},"Last Resolved Date",[102,2494,2495,2503,2511,2519,2526,2533,2541,2548,2555,2562,2569,2576,2583,2590,2598,2605,2612,2619,2626,2633,2640,2648,2656,2663,2670,2677,2684,2691,2698,2705,2712,2719,2726,2733,2740,2748,2755,2762,2769,2776,2783,2790,2797,2805,2812,2820,2827,2834,2842,2849,2857,2864,2871,2878,2885,2892,2900,2907,2915,2922,2930,2938,2945,2952,2960,2968,2975,2982,2989,2996,3003,3010,3017,3024,3031,3038,3045,3052,3060,3067,3074,3081,3088,3095,3102,3109,3116,3123,3130,3137,3144,3151,3158,3165,3173,3180,3187,3195,3202,3209,3216,3224,3231,3238,3245,3252,3259,3266,3273,3280,3287,3294,3301,3308,3315,3323,3330,3337,3344,3351,3358,3365,3372,3379,3386,3393,3400,3407,3414,3421,3428,3435,3442,3449,3456,3463,3470,3477,3484,3491,3498,3505,3512,3519,3526,3533,3540,3547,3554,3561,3569,3576,3583,3590,3598,3605,3612,3619,3626,3633,3640,3647,3654,3661,3668,3675,3683,3690,3697,3704,3711,3718,3725,3733,3740,3747,3754,3761,3768,3775,3782,3789,3796,3803,3810,3817,3824,3831,3839,3846,3853,3860,3867,3874,3881,3888,3895,3902,3909,3916,3923,3931,3939,3946,3953,3960,3967,3974,3981,3988,3995,4002,4009,4016,4023,4031,4038,4045,4053,4060,4067,4074,4081,4088,4095,4102,4109,4116,4123,4130,4137,4144,4151,4158,4165,4172,4179,4186,4193,4200,4207,4215],{},[80,2496,2497,2500],{},[107,2498,2499],{},"1st-euro.net",[107,2501,2502],{},"2020-04-27",[80,2504,2505,2508],{},[107,2506,2507],{},"2hard4you.com",[107,2509,2510],{},"2020-04-29",[80,2512,2513,2516],{},[107,2514,2515],{},"32399753810sb.com",[107,2517,2518],{},"2019-10-29",[80,2520,2521,2524],{},[107,2522,2523],{},"39832302670sb.com",[107,2525,2518],{},[80,2527,2528,2531],{},[107,2529,2530],{},"404fizzy.com",[107,2532,2510],{},[80,2534,2535,2538],{},[107,2536,2537],{},"53nn0r4x.org",[107,2539,2540],{},"2020-05-02",[80,2542,2543,2546],{},[107,2544,2545],{},"ablegod.net",[107,2547,2502],{},[80,2549,2550,2553],{},[107,2551,2552],{},"adobe-results.net",[107,2554,2502],{},[80,2556,2557,2560],{},[107,2558,2559],{},"adobepdf.org",[107,2561,2540],{},[80,2563,2564,2567],{},[107,2565,2566],{},"adobexx.com",[107,2568,2510],{},[80,2570,2571,2574],{},[107,2572,2573],{},"akangs.com",[107,2575,2510],{},[80,2577,2578,2581],{},[107,2579,2580],{},"alli7f9651a12362cec298fe16c1574dcead.com",[107,2582,2518],{},[80,2584,2585,2588],{},[107,2586,2587],{},"amaslim.com",[107,2589,2510],{},[80,2591,2592,2595],{},[107,2593,2594],{},"ap13rc3.com",[107,2596,2597],{},"2019-10-03",[80,2599,2600,2603],{},[107,2601,2602],{},"apelngentots.com",[107,2604,2510],{},[80,2606,2607,2610],{},[107,2608,2609],{},"aplasitecomcom.com",[107,2611,2510],{},[80,2613,2614,2617],{},[107,2615,2616],{},"approject.net",[107,2618,2502],{},[80,2620,2621,2624],{},[107,2622,2623],{},"armcokeresulter.com",[107,2625,2510],{},[80,2627,2628,2631],{},[107,2629,2630],{},"asdhfkjds.com",[107,2632,2510],{},[80,2634,2635,2638],{},[107,2636,2637],{},"asdsadsa.com",[107,2639,2510],{},[80,2641,2642,2645],{},[107,2643,2644],{},"astsmtp.org",[107,2646,2647],{},"2019-10-11",[80,2649,2650,2653],{},[107,2651,2652],{},"balusaz.com",[107,2654,2655],{},"2020-03-29",[80,2657,2658,2661],{},[107,2659,2660],{},"banglemail.com",[107,2662,2510],{},[80,2664,2665,2668],{},[107,2666,2667],{},"baonlineintl.com",[107,2669,2510],{},[80,2671,2672,2675],{},[107,2673,2674],{},"bdcimail.com",[107,2676,2510],{},[80,2678,2679,2682],{},[107,2680,2681],{},"blckman.com",[107,2683,2510],{},[80,2685,2686,2689],{},[107,2687,2688],{},"blowjoob.com",[107,2690,2510],{},[80,2692,2693,2696],{},[107,2694,2695],{},"blurdybloop.com",[107,2697,2510],{},[80,2699,2700,2703],{},[107,2701,2702],{},"boarsw1.com",[107,2704,2510],{},[80,2706,2707,2710],{},[107,2708,2709],{},"boarsw11.com",[107,2711,2510],{},[80,2713,2714,2717],{},[107,2715,2716],{},"boarsw2.com",[107,2718,2510],{},[80,2720,2721,2723],{},[107,2722,2395],{},[107,2724,2725],{},"2020-05-03",[80,2727,2728,2731],{},[107,2729,2730],{},"btemailsupport.com",[107,2732,2510],{},[80,2734,2735,2738],{},[107,2736,2737],{},"c0x1.com",[107,2739,2510],{},[80,2741,2742,2745],{},[107,2743,2744],{},"c1onet.com",[107,2746,2747],{},"2019-10-19",[80,2749,2750,2753],{},[107,2751,2752],{},"cc-result.com",[107,2754,2510],{},[80,2756,2757,2760],{},[107,2758,2759],{},"ch3rsw2.com",[107,2761,2510],{},[80,2763,2764,2767],{},[107,2765,2766],{},"charles-robinson.com",[107,2768,2510],{},[80,2770,2771,2774],{},[107,2772,2773],{},"chasemelom.com",[107,2775,2510],{},[80,2777,2778,2781],{},[107,2779,2780],{},"chsw11.com",[107,2782,2510],{},[80,2784,2785,2788],{},[107,2786,2787],{},"chsww4.com",[107,2789,2510],{},[80,2791,2792,2795],{},[107,2793,2794],{},"cielo2012.com",[107,2796,2510],{},[80,2798,2799,2802],{},[107,2800,2801],{},"clientcaf.info",[107,2803,2804],{},"2020-04-28",[80,2806,2807,2810],{},[107,2808,2809],{},"cnutzdtrk.com",[107,2811,2510],{},[80,2813,2814,2817],{},[107,2815,2816],{},"coin-c.pro",[107,2818,2819],{},"2020-01-30",[80,2821,2822,2825],{},[107,2823,2824],{},"ctrhackschool.com",[107,2826,2510],{},[80,2828,2829,2832],{},[107,2830,2831],{},"d1berkati.net",[107,2833,2725],{},[80,2835,2836,2839],{},[107,2837,2838],{},"d3sxsrw.com",[107,2840,2841],{},"2019-11-12",[80,2843,2844,2847],{},[107,2845,2846],{},"darego.org",[107,2848,2540],{},[80,2850,2851,2854],{},[107,2852,2853],{},"dav1nc1.com",[107,2855,2856],{},"2019-08-07",[80,2858,2859,2862],{},[107,2860,2861],{},"denate-djf88.com",[107,2863,2510],{},[80,2865,2866,2869],{},[107,2867,2868],{},"devexoxfamjackpot.org",[107,2870,2856],{},[80,2872,2873,2876],{},[107,2874,2875],{},"docusign1.com",[107,2877,2510],{},[80,2879,2880,2883],{},[107,2881,2882],{},"donking.net",[107,2884,2502],{},[80,2886,2887,2890],{},[107,2888,2889],{},"dpvmx.com",[107,2891,2510],{},[80,2893,2894,2897],{},[107,2895,2896],{},"dullandstupidfolks.com",[107,2898,2899],{},"2019-10-26",[80,2901,2902,2905],{},[107,2903,2904],{},"eaglesmail.net",[107,2906,2502],{},[80,2908,2909,2912],{},[107,2910,2911],{},"eentertainment.site",[107,2913,2914],{},"2019-09-13",[80,2916,2917,2920],{},[107,2918,2919],{},"esqhackschool.com",[107,2921,2510],{},[80,2923,2924,2927],{},[107,2925,2926],{},"expertgz.com",[107,2928,2929],{},"2020-03-22",[80,2931,2932,2935],{},[107,2933,2934],{},"familytreetmatter.com",[107,2936,2937],{},"2019-11-13",[80,2939,2940,2943],{},[107,2941,2942],{},"fcwbanking.com",[107,2944,2510],{},[80,2946,2947,2950],{},[107,2948,2949],{},"forcadesempre.com",[107,2951,2510],{},[80,2953,2954,2957],{},[107,2955,2956],{},"fortiittechnology.com",[107,2958,2959],{},"2019-08-21",[80,2961,2962,2965],{},[107,2963,2964],{},"freakzbrothers.team",[107,2966,2967],{},"2019-10-25",[80,2969,2970,2973],{},[107,2971,2972],{},"frreer.com",[107,2974,2510],{},[80,2976,2977,2980],{},[107,2978,2979],{},"garutc0de.com",[107,2981,2510],{},[80,2983,2984,2987],{},[107,2985,2986],{},"gcrele.com",[107,2988,2510],{},[80,2990,2991,2994],{},[107,2992,2993],{},"ggledocblessing.com",[107,2995,2510],{},[80,2997,2998,3001],{},[107,2999,3000],{},"ggledocs.com",[107,3002,2510],{},[80,3004,3005,3008],{},[107,3006,3007],{},"globizsolution.com",[107,3009,2725],{},[80,3011,3012,3015],{},[107,3013,3014],{},"gmailphish.com",[107,3016,2510],{},[80,3018,3019,3022],{},[107,3020,3021],{},"gmdddail.com",[107,3023,2510],{},[80,3025,3026,3029],{},[107,3027,3028],{},"goldenboyplanet.net",[107,3030,2502],{},[80,3032,3033,3036],{},[107,3034,3035],{},"goldenmarine.net",[107,3037,2502],{},[80,3039,3040,3043],{},[107,3041,3042],{},"goodpostman.com",[107,3044,2510],{},[80,3046,3047,3050],{},[107,3048,3049],{},"googdocs.org",[107,3051,2540],{},[80,3053,3054,3057],{},[107,3055,3056],{},"groovypigthing.com",[107,3058,3059],{},"2019-12-13",[80,3061,3062,3065],{},[107,3063,3064],{},"h4l1f4x.com",[107,3066,2510],{},[80,3068,3069,3072],{},[107,3070,3071],{},"humaxgifts.net",[107,3073,2502],{},[80,3075,3076,3079],{},[107,3077,3078],{},"hyzeek.com",[107,3080,2510],{},[80,3082,3083,3086],{},[107,3084,3085],{},"idbte4m.com",[107,3087,2510],{},[80,3089,3090,3093],{},[107,3091,3092],{},"idyat.com",[107,3094,2510],{},[80,3096,3097,3100],{},[107,3098,3099],{},"iestoreakeup.com",[107,3101,2510],{},[80,3103,3104,3107],{},[107,3105,3106],{},"ifastnet1.com",[107,3108,2510],{},[80,3110,3111,3114],{},[107,3112,3113],{},"ilekunanu.com",[107,3115,2725],{},[80,3117,3118,3121],{},[107,3119,3120],{},"iln-mc.net",[107,3122,2502],{},[80,3124,3125,3128],{},[107,3126,3127],{},"immaculatelord.com",[107,3129,2510],{},[80,3131,3132,3135],{},[107,3133,3134],{},"inforezult.com",[107,3136,2510],{},[80,3138,3139,3142],{},[107,3140,3141],{},"infulz.org",[107,3143,2540],{},[80,3145,3146,3149],{},[107,3147,3148],{},"inv3st3c.com",[107,3150,2518],{},[80,3152,3153,3156],{},[107,3154,3155],{},"j4nn1ck.com",[107,3157,2510],{},[80,3159,3160,3163],{},[107,3161,3162],{},"jephy-webmail.com",[107,3164,2510],{},[80,3166,3167,3170],{},[107,3168,3169],{},"jquery-cloud.org",[107,3171,3172],{},"2019-11-15",[80,3174,3175,3178],{},[107,3176,3177],{},"kanbghik.com",[107,3179,2510],{},[80,3181,3182,3185],{},[107,3183,3184],{},"killdemall.com",[107,3186,2510],{},[80,3188,3189,3192],{},[107,3190,3191],{},"kind1.org",[107,3193,3194],{},"2019-09-26",[80,3196,3197,3200],{},[107,3198,3199],{},"kindly2014.com",[107,3201,2510],{},[80,3203,3204,3207],{},[107,3205,3206],{},"kksdfs.com",[107,3208,2510],{},[80,3210,3211,3214],{},[107,3212,3213],{},"kod3r.com",[107,3215,2510],{},[80,3217,3218,3221],{},[107,3219,3220],{},"kucinghitam.team",[107,3222,3223],{},"2019-07-12",[80,3225,3226,3229],{},[107,3227,3228],{},"kuhlcomputer.com",[107,3230,2510],{},[80,3232,3233,3236],{},[107,3234,3235],{},"lagoshacker.com",[107,3237,2510],{},[80,3239,3240,3243],{},[107,3241,3242],{},"lbox1.com",[107,3244,2510],{},[80,3246,3247,3250],{},[107,3248,3249],{},"lbox2.com",[107,3251,2510],{},[80,3253,3254,3257],{},[107,3255,3256],{},"lbox3.com",[107,3258,2510],{},[80,3260,3261,3264],{},[107,3262,3263],{},"legitz-solutions.com",[107,3265,2510],{},[80,3267,3268,3271],{},[107,3269,3270],{},"linksandmail.com",[107,3272,2510],{},[80,3274,3275,3278],{},[107,3276,3277],{},"llgss.com",[107,3279,2510],{},[80,3281,3282,3285],{},[107,3283,3284],{},"magentoscure.com",[107,3286,2510],{},[80,3288,3289,3292],{},[107,3290,3291],{},"mailfahad.com",[107,3293,2510],{},[80,3295,3296,3299],{},[107,3297,3298],{},"mailrez.com",[107,3300,2510],{},[80,3302,3303,3306],{},[107,3304,3305],{},"malancellc.com",[107,3307,2510],{},[80,3309,3310,3313],{},[107,3311,3312],{},"mdhmx.com",[107,3314,2510],{},[80,3316,3317,3320],{},[107,3318,3319],{},"mefffdo.com",[107,3321,3322],{},"2019-10-10",[80,3324,3325,3328],{},[107,3326,3327],{},"menemoney.com",[107,3329,2510],{},[80,3331,3332,3335],{},[107,3333,3334],{},"mimecastphish.com",[107,3336,2510],{},[80,3338,3339,3342],{},[107,3340,3341],{},"minioncc.com",[107,3343,2510],{},[80,3345,3346,3349],{},[107,3347,3348],{},"minionlogin.com",[107,3350,2510],{},[80,3352,3353,3356],{},[107,3354,3355],{},"minionresult.com",[107,3357,2510],{},[80,3359,3360,3363],{},[107,3361,3362],{},"moneysquad.org",[107,3364,2540],{},[80,3366,3367,3370],{},[107,3368,3369],{},"moxxxx.com",[107,3371,2510],{},[80,3373,3374,3377],{},[107,3375,3376],{},"mrspybotv3.com",[107,3378,2510],{},[80,3380,3381,3384],{},[107,3382,3383],{},"mrspybotv4.com",[107,3385,2510],{},[80,3387,3388,3391],{},[107,3389,3390],{},"mteen.net",[107,3392,2502],{},[80,3394,3395,3398],{},[107,3396,3397],{},"mylinklog.com",[107,3399,2510],{},[80,3401,3402,3405],{},[107,3403,3404],{},"mymailgin.com",[107,3406,2510],{},[80,3408,3409,3412],{},[107,3410,3411],{},"mystshop.org",[107,3413,2540],{},[80,3415,3416,3419],{},[107,3417,3418],{},"nationwidez.com",[107,3420,2510],{},[80,3422,3423,3426],{},[107,3424,3425],{},"neids.net",[107,3427,2502],{},[80,3429,3430,3433],{},[107,3431,3432],{},"netzrxflix.com",[107,3434,2510],{},[80,3436,3437,3440],{},[107,3438,3439],{},"newbieking.biz",[107,3441,2540],{},[80,3443,3444,3447],{},[107,3445,3446],{},"newcpanel.com",[107,3448,2510],{},[80,3450,3451,3454],{},[107,3452,3453],{},"notforsal.org",[107,3455,2540],{},[80,3457,3458,3461],{},[107,3459,3460],{},"notinforreal.org",[107,3462,2540],{},[80,3464,3465,3468],{},[107,3466,3467],{},"oluxshopservice.com",[107,3469,2841],{},[80,3471,3472,3475],{},[107,3473,3474],{},"one-sender.com",[107,3476,2510],{},[80,3478,3479,3482],{},[107,3480,3481],{},"oneskilet.team",[107,3483,2929],{},[80,3485,3486,3489],{},[107,3487,3488],{},"oonlo.com",[107,3490,2510],{},[80,3492,3493,3496],{},[107,3494,3495],{},"orimi.co",[107,3497,2540],{},[80,3499,3500,3503],{},[107,3501,3502],{},"otherphish.com",[107,3504,2510],{},[80,3506,3507,3510],{},[107,3508,3509],{},"ourtimesupport.com",[107,3511,2510],{},[80,3513,3514,3517],{},[107,3515,3516],{},"ourtimewhorers.com",[107,3518,2725],{},[80,3520,3521,3524],{},[107,3522,3523],{},"outlookphish.com",[107,3525,2510],{},[80,3527,3528,3531],{},[107,3529,3530],{},"p-delivr.com",[107,3532,2510],{},[80,3534,3535,3538],{},[107,3536,3537],{},"pant8.com",[107,3539,2510],{},[80,3541,3542,3545],{},[107,3543,3544],{},"perpeleran.com",[107,3546,2510],{},[80,3548,3549,3552],{},[107,3550,3551],{},"pollarda.com",[107,3553,2510],{},[80,3555,3556,3559],{},[107,3557,3558],{},"ppaypl.com",[107,3560,2510],{},[80,3562,3563,3566],{},[107,3564,3565],{},"priv8scam.com",[107,3567,3568],{},"2020-02-09",[80,3570,3571,3574],{},[107,3572,3573],{},"priv8scamccforu.com",[107,3575,3568],{},[80,3577,3578,3581],{},[107,3579,3580],{},"private-relay.com",[107,3582,2510],{},[80,3584,3585,3588],{},[107,3586,3587],{},"projectmy.net",[107,3589,2502],{},[80,3591,3592,3595],{},[107,3593,3594],{},"pvscamccsscom.com",[107,3596,3597],{},"2019-09-28",[80,3599,3600,3603],{},[107,3601,3602],{},"pvscamyasscom.com",[107,3604,2510],{},[80,3606,3607,3610],{},[107,3608,3609],{},"pvscamyavscom.com",[107,3611,3597],{},[80,3613,3614,3617],{},[107,3615,3616],{},"qqrez.com",[107,3618,2510],{},[80,3620,3621,3624],{},[107,3622,3623],{},"r36yc.com",[107,3625,2510],{},[80,3627,3628,3631],{},[107,3629,3630],{},"raflipedia.com",[107,3632,2510],{},[80,3634,3635,3638],{},[107,3636,3637],{},"recodz.com",[107,3639,2510],{},[80,3641,3642,3645],{},[107,3643,3644],{},"resulttidaklancar.com",[107,3646,2510],{},[80,3648,3649,3652],{},[107,3650,3651],{},"rezlt.org",[107,3653,2540],{},[80,3655,3656,3659],{},[107,3657,3658],{},"rezltboa.com",[107,3660,2510],{},[80,3662,3663,3666],{},[107,3664,3665],{},"rezult.org",[107,3667,2725],{},[80,3669,3670,3673],{},[107,3671,3672],{},"rezultbossing.com",[107,3674,2510],{},[80,3676,3677,3680],{},[107,3678,3679],{},"rsjkingdomxpp.pro",[107,3681,3682],{},"2019-06-11",[80,3684,3685,3688],{},[107,3686,3687],{},"salkah.com",[107,3689,2510],{},[80,3691,3692,3695],{},[107,3693,3694],{},"saydie.com",[107,3696,2510],{},[80,3698,3699,3702],{},[107,3700,3701],{},"se-holldings.com",[107,3703,2510],{},[80,3705,3706,3709],{},[107,3707,3708],{},"sendmsexcel.com",[107,3710,2510],{},[80,3712,3713,3716],{},[107,3714,3715],{},"serverstrato.net",[107,3717,2502],{},[80,3719,3720,3723],{},[107,3721,3722],{},"serviceadobe.com",[107,3724,2510],{},[80,3726,3727,3730],{},[107,3728,3729],{},"servicedropbox.com",[107,3731,3732],{},"2019-08-24",[80,3734,3735,3738],{},[107,3736,3737],{},"servicesoutlook.com",[107,3739,2510],{},[80,3741,3742,3745],{},[107,3743,3744],{},"servisdocusign.com",[107,3746,2510],{},[80,3748,3749,3752],{},[107,3750,3751],{},"servisdropbox.com",[107,3753,2510],{},[80,3755,3756,3759],{},[107,3757,3758],{},"sidshell.com",[107,3760,2929],{},[80,3762,3763,3766],{},[107,3764,3765],{},"skilet.team",[107,3767,2929],{},[80,3769,3770,3773],{},[107,3771,3772],{},"slackerc0de.com",[107,3774,2510],{},[80,3776,3777,3780],{},[107,3778,3779],{},"slclogin.com",[107,3781,2725],{},[80,3783,3784,3787],{},[107,3785,3786],{},"sn7ak.com",[107,3788,2510],{},[80,3790,3791,3794],{},[107,3792,3793],{},"soutaz.com",[107,3795,2510],{},[80,3797,3798,3801],{},[107,3799,3800],{},"spammerindo.com",[107,3802,2510],{},[80,3804,3805,3808],{},[107,3806,3807],{},"spammerindo.pro",[107,3809,3682],{},[80,3811,3812,3815],{},[107,3813,3814],{},"spirititus.com",[107,3816,2510],{},[80,3818,3819,3822],{},[107,3820,3821],{},"spmers.net",[107,3823,2502],{},[80,3825,3826,3829],{},[107,3827,3828],{},"spyu.org",[107,3830,2540],{},[80,3832,3833,3836],{},[107,3834,3835],{},"srv-app.club",[107,3837,3838],{},"2019-07-02",[80,3840,3841,3844],{},[107,3842,3843],{},"stationlinux.org",[107,3845,2540],{},[80,3847,3848,3851],{},[107,3849,3850],{},"support-itrueserver.xyz",[107,3852,2929],{},[80,3854,3855,3858],{},[107,3856,3857],{},"sureboi.com",[107,3859,2510],{},[80,3861,3862,3865],{},[107,3863,3864],{},"svoooo.com",[107,3866,2510],{},[80,3868,3869,3872],{},[107,3870,3871],{},"sydoppe.com",[107,3873,2510],{},[80,3875,3876,3879],{},[107,3877,3878],{},"synichix.pro",[107,3880,3682],{},[80,3882,3883,3886],{},[107,3884,3885],{},"system42l.net",[107,3887,2502],{},[80,3889,3890,3893],{},[107,3891,3892],{},"t3chsss.net",[107,3894,2502],{},[80,3896,3897,3900],{},[107,3898,3899],{},"teeniecamp4free.com",[107,3901,2510],{},[80,3903,3904,3907],{},[107,3905,3906],{},"teluz.org",[107,3908,3322],{},[80,3910,3911,3914],{},[107,3912,3913],{},"tf-info.com",[107,3915,2510],{},[80,3917,3918,3921],{},[107,3919,3920],{},"tgboi.com",[107,3922,2510],{},[80,3924,3925,3928],{},[107,3926,3927],{},"tgiftoday.biz",[107,3929,3930],{},"2019-08-20",[80,3932,3933,3936],{},[107,3934,3935],{},"thanksforreal.org",[107,3937,3938],{},"2019-12-12",[80,3940,3941,3944],{},[107,3942,3943],{},"theaccessuk.org",[107,3945,2540],{},[80,3947,3948,3951],{},[107,3949,3950],{},"tool4spam.com",[107,3952,2510],{},[80,3954,3955,3958],{},[107,3956,3957],{},"tooolz.com",[107,3959,2510],{},[80,3961,3962,3965],{},[107,3963,3964],{},"tooxlz-db.com",[107,3966,2510],{},[80,3968,3969,3972],{},[107,3970,3971],{},"trowey.com",[107,3973,2510],{},[80,3975,3976,3979],{},[107,3977,3978],{},"tsbdumbs.com",[107,3980,2510],{},[80,3982,3983,3986],{},[107,3984,3985],{},"tt-door.biz",[107,3987,2540],{},[80,3989,3990,3993],{},[107,3991,3992],{},"ttcpanel.com",[107,3994,2510],{},[80,3996,3997,4000],{},[107,3998,3999],{},"twinbash.co",[107,4001,2540],{},[80,4003,4004,4007],{},[107,4005,4006],{},"usaaresults.com",[107,4008,2510],{},[80,4010,4011,4014],{},[107,4012,4013],{},"usaaxa.com",[107,4015,2725],{},[80,4017,4018,4021],{},[107,4019,4020],{},"vgnnb.com",[107,4022,2510],{},[80,4024,4025,4028],{},[107,4026,4027],{},"virus-ma.com",[107,4029,4030],{},"2019-08-09",[80,4032,4033,4036],{},[107,4034,4035],{},"webmai.co",[107,4037,2540],{},[80,4039,4040,4043],{},[107,4041,4042],{},"webmailupdate.com",[107,4044,2510],{},[80,4046,4047,4050],{},[107,4048,4049],{},"willyfucker.com",[107,4051,4052],{},"2019-11-27",[80,4054,4055,4058],{},[107,4056,4057],{},"windowsswebs.com",[107,4059,2518],{},[80,4061,4062,4065],{},[107,4063,4064],{},"wiregang.com",[107,4066,4030],{},[80,4068,4069,4072],{},[107,4070,4071],{},"wirethings.net",[107,4073,2725],{},[80,4075,4076,4079],{},[107,4077,4078],{},"wls1.com",[107,4080,2510],{},[80,4082,4083,4086],{},[107,4084,4085],{},"worldpc2000.com",[107,4087,2510],{},[80,4089,4090,4093],{},[107,4091,4092],{},"xellef-id.com",[107,4094,2510],{},[80,4096,4097,4100],{},[107,4098,4099],{},"xhades.com",[107,4101,2510],{},[80,4103,4104,4107],{},[107,4105,4106],{},"xindex.org",[107,4108,2540],{},[80,4110,4111,4114],{},[107,4112,4113],{},"xsendersecurity.com",[107,4115,2510],{},[80,4117,4118,4121],{},[107,4119,4120],{},"xvbvx.com",[107,4122,2510],{},[80,4124,4125,4128],{},[107,4126,4127],{},"xxsender.com",[107,4129,2510],{},[80,4131,4132,4135],{},[107,4133,4134],{},"xxxsender.com",[107,4136,2510],{},[80,4138,4139,4142],{},[107,4140,4141],{},"yah5oo.com",[107,4143,2510],{},[80,4145,4146,4149],{},[107,4147,4148],{},"yandew.com",[107,4150,2510],{},[80,4152,4153,4156],{},[107,4154,4155],{},"yatdew.com",[107,4157,2510],{},[80,4159,4160,4163],{},[107,4161,4162],{},"youphei.com",[107,4164,3059],{},[80,4166,4167,4170],{},[107,4168,4169],{},"yourzcoolsite.com",[107,4171,3938],{},[80,4173,4174,4177],{},[107,4175,4176],{},"yyuuoo.com",[107,4178,2510],{},[80,4180,4181,4184],{},[107,4182,4183],{},"z1t0ng404.com",[107,4185,2510],{},[80,4187,4188,4191],{},[107,4189,4190],{},"z3ran.com",[107,4192,2510],{},[80,4194,4195,4198],{},[107,4196,4197],{},"zebyinbox.com",[107,4199,2510],{},[80,4201,4202,4205],{},[107,4203,4204],{},"zenquel.com",[107,4206,2510],{},[80,4208,4209,4212],{},[107,4210,4211],{},"zephyrsc.shop",[107,4213,4214],{},"2019-10-23",[80,4216,4217,4220],{},[107,4218,4219],{},"zwirgel.net",[107,4221,2502],{},[17,4223,4224],{},"When we go over it, we can see there are a lot of them that are probably used to create websites for phishing attacks (domains that are close to other big service domains \u002F names), and others for spam and the like. So that gives us a lot of leads to check, we can Google them all and see what comes up, but I don't have the patience to go over results for 242 searches right now. So let's keep it for later, if we need to.",[17,4226,4227,4228,4233],{},"Let's check the website itself. It looks like just a blank page. I did a quick check for the body \u002F headers that returned for the request (as well as for other requests that the web browser did) and I didn't see anything suspicious (like a header on the response that's not supposed to be there, I got there by thinking it'll probably be a ",[23,4229,4232],{"href":4230,"rel":4231},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCommand_and_control",[27],"C2",").",[17,4235,4236,4237,4240,4241,4246],{},"The next question that pops into my head is ",[31,4238,4239],{},"\"was it always a blank page?\"",". We have a way to check it, maybe, sort of. We'll use the ",[23,4242,4245],{"href":4243,"rel":4244},"https:\u002F\u002Fweb.archive.org\u002F",[27],"WayBack Machine"," and we got some results! We can see it saves 3 snapshots, but all of them are the same blank pages.",[17,4248,4249],{},[2439,4250],{"alt":4245,"className":4251,"src":4252},[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fwayback-machine.webp",[17,4254,4255,4256,4258],{},"So this gives us nothing so far. What comes to mind is that it's someone renting a server on DigitalOcean and using proxies to map some parts of the internet and when he gets back ",[205,4257,2424],{}," from a website he tries to login, maybe it's automated login attempts maybe it isn't, I haven't decided yet (because it looks automated but then I was expecting an increase of a number or the next letter in the alphabet, or to add some letter at the end of the password in the second try, if it was automated). Also, it's probably someone (or a bunch of people) who's doing some phishing and \u002F or spam stuff.",[60,4260,4262],{"id":4261},"_3-like-a-dog-with-a-bone","3. Like a dog with a bone",[17,4264,4265,4266,4271],{},"This is not the end of the line, it's just the start. Let's keep digging! A tool I love to use is ",[23,4267,4270],{"href":4268,"rel":4269},"https:\u002F\u002Fsitereport.netcraft.com",[27],"Netcraft Site Report",", when I run the domain in their service we finally start to see more results.",[17,4273,4274],{},[2439,4275],{"alt":4276,"className":4277,"src":4278},"Netcraft Report",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fnetcraft-report.webp",[17,4280,4281,4282,4285,4286,4291],{},"We can see the domain registered with ",[205,4283,4284],{},"donuts.co"," (which redirects us to ",[23,4287,4290],{"href":4288,"rel":4289},"https:\u002F\u002Fdonuts.domains",[27],"donuts.domains",") back in 2017! (maybe it was someone else, maybe they forgot to renew it and rebought it with NameCheap, or maybe they transferred it to NameCheap in 2018, who knows? don't really care at this point).",[17,4293,4294,4295,4298,4299,4302,4303,4308,4309,4312,4313,4316,4317,4320,4321,34],{},"The nice thing we find is the organization that purchased the domain back in 2017 (they didn't have a domain privacy protection). It's ",[205,4296,4297],{},"Jalanin aja dulu mhanxx, hax0r, 50701, United States",". First thing that pops up is the word ",[205,4300,4301],{},"hax0r",", this is ",[23,4304,4307],{"href":4305,"rel":4306},"https:\u002F\u002Fsimple.wikipedia.org\u002Fwiki\u002FLeet",[27],"1337 speak (or leet)"," and it is used on the internet in forums, chat rooms, online games, etc. The ",[205,4310,4311],{},"0"," in the word is equivalent to ",[205,4314,4315],{},"o"," so it's the word ",[205,4318,4319],{},"haxor"," and it's an ",[23,4322,4325],{"href":4323,"rel":4324},"https:\u002F\u002Fen.wiktionary.org\u002Fwiki\u002Fhaxor",[27],"alternative spelling of hacker or script kiddie",[17,4327,4328],{},"So that's interesting, let's keep our focus on domain \u002F website \u002F server.",[17,4330,4331,4332,4337,4338,4341,4342,4346,4347,4352,4353,4355,4356,4233],{},"More scanning with Netcraft and ",[23,4333,4336],{"href":4334,"rel":4335},"https:\u002F\u002Fbuiltwith.com",[27],"build with"," finds it's probably a Linux server (maybe Ubuntu, based on ",[31,4339,4340],{},"\"build with\"","), and it uses ",[23,4343,4345],{"href":2428,"rel":4344},[27],"Apache",". It used Apache 2.4, for sometime it also had ",[23,4348,4351],{"href":4349,"rel":4350},"https:\u002F\u002Fwww.nginx.com\u002F",[27],"Nginx"," but now we only got \"Apache\". And this domain is active since the end of 2017 (based on ",[31,4354,4340],{}," and ",[31,4357,4358],{},"Netcraft",[17,4360,4361],{},[2439,4362],{"alt":4363,"className":4364,"src":4365,"height":4366,"width":4367},"Build With",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fbuilt-with.webp",539,809,[17,4369,4370],{},[2439,4371],{"alt":4372,"className":4373,"src":4374,"height":4375,"width":4376},"Netcarft Hosting",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fnetcraft-hosting.webp",162,1339,[17,4378,4379,4380,4385],{},"Another big finding from Netcraft is that it uses ",[23,4381,4384],{"href":4382,"rel":4383},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FDMARC",[27],"DMARC",". DMARC is an email authentication protocol, and Netcraft gives us the raw record which details the emails they use for reporting aggregate and failure data.",[243,4387,4391],{"className":4388,"code":4389,"language":4390,"meta":249,"style":249},"language-txt shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","v=DMARC1; p=none; pct=100; fo=1; ri=300; rua=mailto:a@bocah.team; ruf=mailto:f@bocah.team\n","txt",[205,4392,4393],{"__ignoreMap":249},[42,4394,4395],{"class":254,"line":255},[42,4396,4389],{},[17,4398,4399,4400,4405,4406,4408,4409,4411],{},"I'll save those email addresses for later, but now let's keep digging with some other great tool on my list, and one I often use is ",[23,4401,4404],{"href":4402,"rel":4403},"https:\u002F\u002Fspyse.com",[27],"spyse",". It's a cybersecurity search engine to find information about internet assets. When I give it the IP (",[205,4407,2420],{},") of the DigitalOcean server, it finds the ",[205,4410,3950],{}," domain. We already know that domain from our 242 domains list, but this tells me that this domain is probably one of their main ones, and it's an important one.",[17,4413,4414],{},[2439,4415],{"alt":4416,"className":4417,"src":4418,"height":4419,"width":4420},"Spyse Report",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fspyse-report.webp",157,1449,[17,4422,4423,4424,4426,4427,4432,4433,4438],{},"Most of the time everyone will say that scanning is not passive, I can agree with that, but I don't really care. To scan our main target (",[205,4425,2395],{},") I'll use ",[23,4428,4431],{"href":4429,"rel":4430},"https:\u002F\u002Fwww.nmmapper.com",[27],"nmmapper",", and specifically ",[23,4434,4437],{"href":4435,"rel":4436},"https:\u002F\u002Fgithub.com\u002Frbsec\u002Fdnscan",[27],"DNSscan"," tool, it's extremely fast, and it catches so many subdomains!",[17,4440,4441,4442,4444,4445,4447,4448,34],{},"So after I ran the tool I was a little bit in shock, there were so many subdomains it hurts to scroll through them. My current initial assumption is that he must be part of an operation that's done this stuff for years. You can download the ",[205,4443,4390],{}," file with the 780 subdomains it found for ",[205,4446,2395],{}," ",[23,4449,4451],{"href":4450},"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fbocah-team-subdomains-list.txt","here",[17,4453,4454],{},"And let's not forget that this is only one domain that points to that server. We found out that there are 242 domains that point to that server, we can only imagine the subdomains that they also have (I don't intend to run them, it doesn't interest me).",[17,4456,4457,4458,4461,4462,4464,4465,4470,4471,4355,4473,4476],{},"The last thing I want to check with their server (for now) is if maybe there are some query parameters their server gets and we don't know about, because we're just doing a ",[205,4459,4460],{},"GET"," request with no parameters to their domain (",[205,4463,2395],{},"). Luckily there is a tool to help us do it, ",[23,4466,4469],{"href":4467,"rel":4468},"https:\u002F\u002Fgithub.com\u002Fs0md3v\u002FArjun",[27],"Arjun"," for the rescue. Arjun sends ",[205,4472,4460],{},[205,4474,4475],{},"POST"," requests with different query parameters (from a huge list of 25,980 parameters).",[17,4478,4479,4480,4482,4483,4485],{},"Unfortunately, when I did a ",[205,4481,4460],{}," and a ",[205,4484,4475],{}," requests, Arjun didn't come up with anything.",[17,4487,4488],{},[2439,4489],{"alt":4490,"className":4491,"src":4492,"height":4493,"width":4494},"Arjun Search",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Farjun-search.webp",569,603,[60,4496,4498],{"id":4497},"_4-found-him-maybe","4. Found him! Maybe..",[17,4500,4501,4502,4504,4505,4510,4511,4513,4514,4516],{},"It's time to search a little about our new finding ",[205,4503,3950],{},". Let's go to ",[23,4506,4509],{"href":4507,"rel":4508},"http:\u002F\u002Fhunter.io",[27],"hunter.io"," and check for ",[205,4512,3950],{}," - didn't come up with anything, but we have another domain (let's not forget about it), a scan for ",[205,4515,2395],{}," comes up with an email address!",[17,4518,4519],{},[2439,4520],{"alt":4521,"className":4522,"src":4523,"height":4524,"width":4525},"Hunter Result",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fhunter-result.webp",381,777,[17,4527,4528],{},"In the source website there is also a phone number (and google translate says the website is in Danish).",[17,4530,4531],{},[2439,4532],{"alt":4533,"className":4534,"src":4535,"height":4536,"width":4537},"Hunter Source",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fhunter-source.webp",354,287,[17,4539,4540,4541,4544,4545,4550,4551,4556,4557,4562,4563,4567,4568,4571,4572,4571,4575,4578],{},"When we search Google for ",[205,4542,4543],{},"johnny_pacocha@bocah.team"," we found another site (apart from the one hunter points us to). This website is ",[23,4546,4549],{"href":4547,"rel":4548},"https:\u002F\u002Fwww.ceqoya.com",[27],"ceqoya"," which is a \"A search engine that helps NGO and ecological projects\", in this search engine there are a couple of links to Bocah Team (apparently it's a ",[23,4552,4555],{"href":4553,"rel":4554},"https:\u002F\u002Fwww.facebook.com\u002FBocah-Team-New-579200705444594\u002Fphotos",[27],"Sports Team","), but we find a new link, to ",[23,4558,4561],{"href":4559,"rel":4560},"https:\u002F\u002Fpastebin.com",[27],"pastebin",": ",[23,4564,4565],{"href":4565,"rel":4566},"https:\u002F\u002Fpastebin.com\u002F8yDPutJQ",[27],". This contains PHP code that is basically an Apple scam page with a couple more email addresses ",[205,4569,4570],{},"empas.apel@bocah.team",", ",[205,4573,4574],{},"apel@bocah.team",[205,4576,4577],{},"report.apel@bocah.team"," with our target domain.",[17,4580,4581,4582,4585,4586,4589,4590,4595],{},"This user has more pastes in his profile (his profile name is ",[205,4583,4584],{},"Inboxplis","), but the common thing is that they have a gmail address (",[205,4587,4588],{},"slikeye1711@gmail.com",") in the code with a link to his ",[23,4591,4594],{"href":4592,"rel":4593},"https:\u002F\u002Fwww.facebook.com\u002FSlikeye",[27],"Facebook profile page","!",[17,4597,4598],{},[2439,4599],{"alt":4600,"className":4601,"src":4602,"height":4603,"width":4604},"Dian Wahyudi Facebook Profile",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fdian-wahyudi-facebook-profile.webp",1270,969,[17,4606,4607,4608,4613],{},"In his Facebook photos there is ",[23,4609,4612],{"href":4610,"rel":4611},"https:\u002F\u002Fwww.facebook.com\u002Fphoto.php?fbid=718884434960573&set=pb.100005170683150.-2207520000..&type=3",[27],"a photo"," about some Hacking \u002F Script Kiddies book in Indonesian back in April 2017. Also from his photos I can notice he has an Asus laptop with a Windows 10 on it, and that he does a lot of small money transfers.",[17,4615,4616,4617,4619,4620,4622,4623,4626],{},"When I go back to the organization I found earlier, the report from Netcraft when they registered ",[205,4618,2395],{}," in 2017, the one we found earlier (",[205,4621,4297],{},") and put the part \"Jalanin aja dulu mhanxx\" in Google Translate (on ",[31,4624,4625],{},"detect language",") it comes up as Indonesian and it means \"Just do it first mhanxx\".",[17,4628,4629,4630,4633],{},"The guy on the Facebook profile page I found is from Indonesia (he wrote it there and the language he write in his posts is Indonesian). So this is a big clue that it's probably our guy. Or is it? The big question now is: ",[55,4631,4632],{},"Is this our person?"," I think we need to find more evidence.",[17,4635,4636],{},"Quick Recap:",[4638,4639,4640,4643,4649,4655],"ol",{},[192,4641,4642],{},"He is from Indonesia (posts language and from his profile) and the domain registration details have Indonesian words in it.",[192,4644,4645,4646,4648],{},"He has a hacking book and the domain registered details have the ",[205,4647,4301],{}," word in it, which is another word for hacker or script kiddie.",[192,4650,4651,4652,4654],{},"There are a lot of phishing \u002F spam domains (like ",[205,4653,3950],{},") that points to the same server and he seems like a spammer (a lot of small money transactions, and a script kiddie \u002F spammer book).",[192,4656,4657,4658,4660,4661,4663],{},"The Pastebin paste with the ",[205,4659,2395],{}," domain and ",[205,4662,3950],{}," domain in it have also his email and Facebook profile page.",[17,4665,4666],{},"It looks like our guy, but this is not enough! We need more.",[60,4668,4670],{"id":4669},"_5-take-it-up-a-notch","5. Take It Up a Notch",[17,4672,4673,4674,4676,4677,4682],{},"Let's search his gmail (",[205,4675,4588],{},") on ",[23,4678,4681],{"href":4679,"rel":4680},"https:\u002F\u002Fpipl.com",[27],"Pipl",", unfortunately we got nothing.",[243,4684,4687],{"className":245,"code":4685,"filename":4686,"language":248,"meta":249,"style":249},"{\n  \"@http_status_code\": 200,\n  \"@visible_sources\": 0,\n  \"@available_sources\": 0,\n  \"@persons_count\": 0,\n  \"@search_id\": \"2005021646181212464187518983203646144\",\n  \"query\": {\n    \"emails\": [\n      {\n        \"@type\": \"personal\",\n        \"address\": \"slikeye1711@gmail.com\",\n        \"address_md5\": \"5852a05e2315661b759ee006ef3bc006\"\n      }\n    ]\n  }\n}\n","pipl.json",[205,4688,4689,4693,4709,4725,4740,4755,4775,4788,4801,4805,4825,4844,4862,4866,4871,4875],{"__ignoreMap":249},[42,4690,4691],{"class":254,"line":255},[42,4692,259],{"class":258},[42,4694,4695,4697,4700,4702,4704,4707],{"class":254,"line":262},[42,4696,265],{"class":258},[42,4698,4699],{"class":268},"@http_status_code",[42,4701,272],{"class":258},[42,4703,275],{"class":258},[42,4705,4706],{"class":490}," 200",[42,4708,286],{"class":258},[42,4710,4711,4713,4716,4718,4720,4723],{"class":254,"line":289},[42,4712,265],{"class":258},[42,4714,4715],{"class":268},"@visible_sources",[42,4717,272],{"class":258},[42,4719,275],{"class":258},[42,4721,4722],{"class":490}," 0",[42,4724,286],{"class":258},[42,4726,4727,4729,4732,4734,4736,4738],{"class":254,"line":310},[42,4728,265],{"class":258},[42,4730,4731],{"class":268},"@available_sources",[42,4733,272],{"class":258},[42,4735,275],{"class":258},[42,4737,4722],{"class":490},[42,4739,286],{"class":258},[42,4741,4742,4744,4747,4749,4751,4753],{"class":254,"line":331},[42,4743,265],{"class":258},[42,4745,4746],{"class":268},"@persons_count",[42,4748,272],{"class":258},[42,4750,275],{"class":258},[42,4752,4722],{"class":490},[42,4754,286],{"class":258},[42,4756,4757,4759,4762,4764,4766,4768,4771,4773],{"class":254,"line":352},[42,4758,265],{"class":258},[42,4760,4761],{"class":268},"@search_id",[42,4763,272],{"class":258},[42,4765,275],{"class":258},[42,4767,278],{"class":258},[42,4769,4770],{"class":281},"2005021646181212464187518983203646144",[42,4772,272],{"class":258},[42,4774,286],{"class":258},[42,4776,4777,4779,4782,4784,4786],{"class":254,"line":373},[42,4778,265],{"class":258},[42,4780,4781],{"class":268},"query",[42,4783,272],{"class":258},[42,4785,275],{"class":258},[42,4787,525],{"class":258},[42,4789,4790,4792,4795,4797,4799],{"class":254,"line":394},[42,4791,531],{"class":258},[42,4793,4794],{"class":534},"emails",[42,4796,272],{"class":258},[42,4798,275],{"class":258},[42,4800,580],{"class":258},[42,4802,4803],{"class":254,"line":415},[42,4804,586],{"class":258},[42,4806,4807,4809,4812,4814,4816,4818,4821,4823],{"class":254,"line":436},[42,4808,592],{"class":258},[42,4810,4811],{"class":490},"@type",[42,4813,272],{"class":258},[42,4815,275],{"class":258},[42,4817,278],{"class":258},[42,4819,4820],{"class":281},"personal",[42,4822,272],{"class":258},[42,4824,286],{"class":258},[42,4826,4827,4829,4832,4834,4836,4838,4840,4842],{"class":254,"line":457},[42,4828,592],{"class":258},[42,4830,4831],{"class":490},"address",[42,4833,272],{"class":258},[42,4835,275],{"class":258},[42,4837,278],{"class":258},[42,4839,4588],{"class":281},[42,4841,272],{"class":258},[42,4843,286],{"class":258},[42,4845,4846,4848,4851,4853,4855,4857,4860],{"class":254,"line":478},[42,4847,592],{"class":258},[42,4849,4850],{"class":490},"address_md5",[42,4852,272],{"class":258},[42,4854,275],{"class":258},[42,4856,278],{"class":258},[42,4858,4859],{"class":281},"5852a05e2315661b759ee006ef3bc006",[42,4861,648],{"class":258},[42,4863,4864],{"class":254,"line":496},[42,4865,654],{"class":258},[42,4867,4868],{"class":254,"line":513},[42,4869,4870],{"class":258},"    ]\n",[42,4872,4873],{"class":254,"line":528},[42,4874,1053],{"class":258},[42,4876,4877],{"class":254,"line":547},[42,4878,1059],{"class":258},[17,4880,4881,4882,4887],{},"Let's check his email in ",[23,4883,4886],{"href":4884,"rel":4885},"https:\u002F\u002Fhaveibeenpwned.com\u002F",[27],"have i been pwned",", and we got a match!",[17,4889,4890],{},[2439,4891],{"alt":4892,"className":4893,"src":4894,"height":4895,"width":4896},"Have I Been Pwned Search",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fhaveibeenpwned.webp",941,955,[17,4898,4899,4900,4903,4904,4907],{},"His email is on the Canva database leak, so I started to search this database leak on the internet, and it wasn't that hard to find. I found two types of files, the first is a single file that appears to be the whole info of the users, but it says ",[31,4901,4902],{},"\"cleaned\""," in the file name, and some fields are not there, for example the ",[205,4905,4906],{},"password"," is obviously a basic and it's not there.",[74,4909,4910,4980],{},[77,4911,4912],{},[80,4913,4914,4917,4920,4923,4926,4929,4932,4935,4938,4941,4944,4947,4950,4953,4956,4959,4962,4965,4968,4971,4974,4977],{},[83,4915,4916],{},"ID",[83,4918,4919],{},"ID_HASH",[83,4921,4922],{},"CREATE_DATE",[83,4924,4925],{},"MAIL",[83,4927,4928],{},"PHONE",[83,4930,4931],{},"MAIL_STATUS",[83,4933,4934],{},"USERNAME",[83,4936,4937],{},"DISPLAY_NAME",[83,4939,4940],{},"NAME1",[83,4942,4943],{},"NAME2",[83,4945,4946],{},"TEMPORARY",[83,4948,4949],{},"ROLES",[83,4951,4952],{},"DEACTIVATED",[83,4954,4955],{},"UI_INFO",[83,4957,4958],{},"HOMEPAGE",[83,4960,4961],{},"CITY",[83,4963,4964],{},"COUNTRY_CODE",[83,4966,4967],{},"LOCALE",[83,4969,4970],{},"PERSONAL_BRAND",[83,4972,4973],{},"PERSONAL_BRAND_ID",[83,4975,4976],{},"AVATAR",[83,4978,4979],{},"HASH",[102,4981,4982],{},[80,4983,4984,4987,4990,4993,4998,5000,5003,5006,5009,5011,5013,5015,5018,5020,5023,5025,5027,5029,5031,5034,5037,5039],{},[107,4985,4986],{},"48222628",[107,4988,4989],{},"UAClrvf92U8",[107,4991,4992],{},"2017-11-03 06:25:39",[107,4994,4995],{},[23,4996,4588],{"href":4997},"mailto:slikeye1711@gmail.com",[107,4999],{},[107,5001,5002],{},"C",[107,5004,5005],{},"slikeye1711",[107,5007,5008],{},"Dian Wahyudi",[107,5010],{},[107,5012],{},[107,5014,4311],{},[107,5016,5017],{},"U",[107,5019,4311],{},[107,5021,5022],{},"{contextTipRoyaltyFreePaymentOption:true;hasSeenPublishPaymentLicensesOnboarding:true}",[107,5024],{},[107,5026],{},[107,5028],{},[107,5030,1430],{},[107,5032,5033],{},"48163206",[107,5035,5036],{},"BAClrn9xkI4",[107,5038],{},[107,5040],{},[17,5042,5043,5044,5047],{},"The second type of files that I found is couple of small files with a list of ",[205,5045,5046],{},"emails:pass",", but unfortunately his email wasn't in any one of them.",[17,5049,5050,5051,5054,5055,5060],{},"So let's think of something different, in his profile page there was a new domain I hadn't seen before, ",[205,5052,5053],{},"slikeye.com",". I checked it with DomainTools Whois, and it was also protected. So I searched it in Google and we have a couple of hits. The first and second results are his ",[23,5056,5059],{"href":5057,"rel":5058},"https:\u002F\u002Fwww.instagram.com\u002Fdianwhyd",[27],"Instagram profile",", but it's private.",[17,5062,5063,5064,5069,5070,5073],{},"The third result is really interesting, it's from ",[23,5065,5068],{"href":5066,"rel":5067},"https:\u002F\u002Fwww.cutestat.com",[27],"cutestat website",", which is a website that provides various statistical reports like website valuation, traffic reports, social engagement, host information, domain WHOIS, etc. and it's perfect because it has a WHOIS record from ",[205,5071,5072],{},"2017-06-14T17:05:39Z"," with new data (probably before he had privacy protection on the domain).",[243,5075,5077],{"className":4388,"code":5076,"language":4390,"meta":249,"style":249},"Domain Name: SLIKEYE.COM\nRegistry Domain ID: 2132972393_DOMAIN_COM-VRSN\nRegistrar WHOIS Server: whois.resellercamp.com\nRegistrar URL: http:\u002F\u002Fresellercamp.com\u002F\nUpdated Date: 2017-06-12T12:33:20Z\nCreation Date: 2017-06-12T12:33:14Z\nRegistrar Registration Expiration Date: 2018-06-12T12:33:14Z\nRegistrar: CV. Jogjacamp\nRegistrar IANA ID: 1478\nRegistrar Abuse Contact Email: abuse@resellercamp.com\nRegistrar Abuse Contact Phone: +62.82141570000\nDomain Status: clientTransferProhibited (http:\u002F\u002Ficann.org\u002Fepp#clientTransferProhibited)\nRegistry Registrant ID:\nRegistrant Name: dian Wahyudi\nRegistrant Organization: pribadi\nRegistrant Street: Kutajaya no.15 Rt.03 Rw.01\nRegistrant City: bogor\nRegistrant State\u002FProvince: Jawa Barat\nRegistrant Postal Code: 16131\nRegistrant Country: ID\nRegistrant Phone: +62.87770307854\nRegistrant Phone Ext:\nRegistrant Fax:\nRegistrant Fax Ext:\nRegistrant Email: diansoft1711@gmail.com\nRegistry Admin ID:\nAdmin Name: dian Wahyudi\nAdmin Organization: pribadi\nAdmin Street: Kutajaya no.15 Rt.03 Rw.01\nAdmin City: bogor\nAdmin State\u002FProvince: Jawa Barat\nAdmin Postal Code: 16131\nAdmin Country: ID\nAdmin Phone: +62.87770307854\nAdmin Phone Ext:\nAdmin Fax:\nAdmin Fax Ext:\nAdmin Email: diansoft1711@gmail.com\nRegistry Tech ID:\nTech Name: dian Wahyudi\nTech Organization: pribadi\nTech Street: Kutajaya no.15 Rt.03 Rw.01\nTech City: bogor\nTech State\u002FProvince: Jawa Barat\nTech Postal Code: 16131\nTech Country: ID\nTech Phone: +62.87770307854\nTech Phone Ext:\nTech Fax:\nTech Fax Ext:\nTech Email: diansoft1711@gmail.com\nName Server: ns1.domainesia.net\nName Server: ns2.domainesia.net\nDNSSEC: Unsigned\nURL of the ICANN Whois Inaccuracy Complaint Form: https:\u002F\u002Fwww.icann.org\u002Fwicf\u002F\n",[205,5078,5079,5084,5089,5094,5099,5104,5109,5114,5119,5124,5129,5134,5139,5144,5149,5154,5159,5164,5169,5174,5179,5184,5189,5194,5199,5204,5209,5214,5219,5224,5229,5234,5239,5244,5249,5254,5259,5264,5269,5274,5279,5284,5289,5294,5299,5304,5309,5314,5319,5324,5329,5334,5339,5344,5349],{"__ignoreMap":249},[42,5080,5081],{"class":254,"line":255},[42,5082,5083],{},"Domain Name: SLIKEYE.COM\n",[42,5085,5086],{"class":254,"line":262},[42,5087,5088],{},"Registry Domain ID: 2132972393_DOMAIN_COM-VRSN\n",[42,5090,5091],{"class":254,"line":289},[42,5092,5093],{},"Registrar WHOIS Server: whois.resellercamp.com\n",[42,5095,5096],{"class":254,"line":310},[42,5097,5098],{},"Registrar URL: http:\u002F\u002Fresellercamp.com\u002F\n",[42,5100,5101],{"class":254,"line":331},[42,5102,5103],{},"Updated Date: 2017-06-12T12:33:20Z\n",[42,5105,5106],{"class":254,"line":352},[42,5107,5108],{},"Creation Date: 2017-06-12T12:33:14Z\n",[42,5110,5111],{"class":254,"line":373},[42,5112,5113],{},"Registrar Registration Expiration Date: 2018-06-12T12:33:14Z\n",[42,5115,5116],{"class":254,"line":394},[42,5117,5118],{},"Registrar: CV. Jogjacamp\n",[42,5120,5121],{"class":254,"line":415},[42,5122,5123],{},"Registrar IANA ID: 1478\n",[42,5125,5126],{"class":254,"line":436},[42,5127,5128],{},"Registrar Abuse Contact Email: abuse@resellercamp.com\n",[42,5130,5131],{"class":254,"line":457},[42,5132,5133],{},"Registrar Abuse Contact Phone: +62.82141570000\n",[42,5135,5136],{"class":254,"line":478},[42,5137,5138],{},"Domain Status: clientTransferProhibited (http:\u002F\u002Ficann.org\u002Fepp#clientTransferProhibited)\n",[42,5140,5141],{"class":254,"line":496},[42,5142,5143],{},"Registry Registrant ID:\n",[42,5145,5146],{"class":254,"line":513},[42,5147,5148],{},"Registrant Name: dian Wahyudi\n",[42,5150,5151],{"class":254,"line":528},[42,5152,5153],{},"Registrant Organization: pribadi\n",[42,5155,5156],{"class":254,"line":547},[42,5157,5158],{},"Registrant Street: Kutajaya no.15 Rt.03 Rw.01\n",[42,5160,5161],{"class":254,"line":568},[42,5162,5163],{},"Registrant City: bogor\n",[42,5165,5166],{"class":254,"line":583},[42,5167,5168],{},"Registrant State\u002FProvince: Jawa Barat\n",[42,5170,5171],{"class":254,"line":589},[42,5172,5173],{},"Registrant Postal Code: 16131\n",[42,5175,5176],{"class":254,"line":610},[42,5177,5178],{},"Registrant Country: ID\n",[42,5180,5181],{"class":254,"line":631},[42,5182,5183],{},"Registrant Phone: +62.87770307854\n",[42,5185,5186],{"class":254,"line":651},[42,5187,5188],{},"Registrant Phone Ext:\n",[42,5190,5191],{"class":254,"line":657},[42,5192,5193],{},"Registrant Fax:\n",[42,5195,5196],{"class":254,"line":663},[42,5197,5198],{},"Registrant Fax Ext:\n",[42,5200,5201],{"class":254,"line":684},[42,5202,5203],{},"Registrant Email: diansoft1711@gmail.com\n",[42,5205,5206],{"class":254,"line":706},[42,5207,5208],{},"Registry Admin ID:\n",[42,5210,5211],{"class":254,"line":727},[42,5212,5213],{},"Admin Name: dian Wahyudi\n",[42,5215,5216],{"class":254,"line":748},[42,5217,5218],{},"Admin Organization: pribadi\n",[42,5220,5221],{"class":254,"line":763},[42,5222,5223],{},"Admin Street: Kutajaya no.15 Rt.03 Rw.01\n",[42,5225,5226],{"class":254,"line":769},[42,5227,5228],{},"Admin City: bogor\n",[42,5230,5231],{"class":254,"line":783},[42,5232,5233],{},"Admin State\u002FProvince: Jawa Barat\n",[42,5235,5236],{"class":254,"line":804},[42,5237,5238],{},"Admin Postal Code: 16131\n",[42,5240,5241],{"class":254,"line":825},[42,5242,5243],{},"Admin Country: ID\n",[42,5245,5246],{"class":254,"line":842},[42,5247,5248],{},"Admin Phone: +62.87770307854\n",[42,5250,5251],{"class":254,"line":862},[42,5252,5253],{},"Admin Phone Ext:\n",[42,5255,5256],{"class":254,"line":876},[42,5257,5258],{},"Admin Fax:\n",[42,5260,5261],{"class":254,"line":881},[42,5262,5263],{},"Admin Fax Ext:\n",[42,5265,5266],{"class":254,"line":895},[42,5267,5268],{},"Admin Email: diansoft1711@gmail.com\n",[42,5270,5271],{"class":254,"line":915},[42,5272,5273],{},"Registry Tech ID:\n",[42,5275,5276],{"class":254,"line":935},[42,5277,5278],{},"Tech Name: dian Wahyudi\n",[42,5280,5281],{"class":254,"line":956},[42,5282,5283],{},"Tech Organization: pribadi\n",[42,5285,5286],{"class":254,"line":977},[42,5287,5288],{},"Tech Street: Kutajaya no.15 Rt.03 Rw.01\n",[42,5290,5291],{"class":254,"line":995},[42,5292,5293],{},"Tech City: bogor\n",[42,5295,5296],{"class":254,"line":1000},[42,5297,5298],{},"Tech State\u002FProvince: Jawa Barat\n",[42,5300,5301],{"class":254,"line":1014},[42,5302,5303],{},"Tech Postal Code: 16131\n",[42,5305,5306],{"class":254,"line":1031},[42,5307,5308],{},"Tech Country: ID\n",[42,5310,5311],{"class":254,"line":1050},[42,5312,5313],{},"Tech Phone: +62.87770307854\n",[42,5315,5316],{"class":254,"line":1056},[42,5317,5318],{},"Tech Phone Ext:\n",[42,5320,5321],{"class":254,"line":1732},[42,5322,5323],{},"Tech Fax:\n",[42,5325,5326],{"class":254,"line":1752},[42,5327,5328],{},"Tech Fax Ext:\n",[42,5330,5331],{"class":254,"line":1772},[42,5332,5333],{},"Tech Email: diansoft1711@gmail.com\n",[42,5335,5336],{"class":254,"line":1790},[42,5337,5338],{},"Name Server: ns1.domainesia.net\n",[42,5340,5341],{"class":254,"line":1795},[42,5342,5343],{},"Name Server: ns2.domainesia.net\n",[42,5345,5346],{"class":254,"line":1800},[42,5347,5348],{},"DNSSEC: Unsigned\n",[42,5350,5351],{"class":254,"line":1820},[42,5352,5353],{},"URL of the ICANN Whois Inaccuracy Complaint Form: https:\u002F\u002Fwww.icann.org\u002Fwicf\u002F\n",[17,5355,5356,5357,5360,5361,5364,5365,5368,5369,5372,5373,4233],{},"We can see words in Indonesian, his name (Dian Wahyudi), and his phone number that also in his Facebook profile, so the domain was his in this date. We can see a physical address (street: ",[205,5358,5359],{},"Kutajaya no.15 Rt.03 Rw.01",", city: ",[205,5362,5363],{},"bogor",", state: ",[205,5366,5367],{},"Jawa Barat",", zip: ",[205,5370,5371],{},"16131","), and a new email (",[205,5374,5375],{},"diansoft1711@gmail.com",[17,5377,5378,5379,5381,5382,5387,5388,5391,5392,5395,5396,34],{},"Before we continue digging with our new findings, let's keep looking in our Google search for ",[205,5380,5053],{},". There was nothing more in there except for the fourth result, it was his ",[23,5383,5386],{"href":5384,"rel":5385},"https:\u002F\u002Ftwitter.com\u002Fdianwhyd",[27],"Twitter profile",". It doesn't look like much, he uploads more photos and talks more in his Facebook profile (he also abandoned Twitter in 2017). But a quick scroll through his tweets with pictures shows a tweet from 2014 with a Facebook login that says \"fb maintenance\", and the start of his email is the ",[205,5389,5390],{},"input"," field. It says ",[205,5393,5394],{},"slikeye"," so it's probably ",[205,5397,4588],{},[17,5399,5400,5401,5404,5405,5407,5408,5410],{},"It's time to do a ",[31,5402,5403],{},"\"Forget Password\""," on Facebook with his email. It got us his last 2 digits in his phone number, and they're the same as the phone number in his Facebook profile and his 2017 WHOIS record for ",[205,5406,5053],{},", so we know it's probably his real and private phone number (also, a ",[31,5409,5403],{}," in Twitter, for the same email, gets us the same 2 last digits).",[17,5412,5413],{},[2439,5414],{"alt":5415,"className":5416,"src":5417},"Facebook Forget Password",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Ffacebook-forget-password.webp",[17,5419,5420,5421,5423],{},"Unfortunately we didn't get new phone numbers or email addresses, but ",[31,5422,5403],{}," is a good method and a lot of times reveals different phone numbers and email addresses that are the private ones of the target.",[60,5425,5427],{"id":5426},"_6-pivoting","6. Pivoting",[17,5429,5430,5431,5434,5435,34],{},"The new email address and phone number don't get us any result on Pipl, that's a bummer. Pipl is consistently failing us in this recon investigation. On the other hand a TrueCaller search for the phone number confirms the new email address we already found in the 2017 WHOIS record, and tells us his ",[205,5432,5433],{},"carrier"," and that he is verified by ",[23,5436,5439],{"href":5437,"rel":5438},"https:\u002F\u002Fwww.truecaller.com",[27],"TrueCaller",[243,5441,5444],{"className":245,"code":5442,"filename":5443,"language":248,"meta":249,"style":249},"{\n  \"data\": [\n    {\n      \"id\": \"lB3vOHRxq8Ek9wc30h2uIA==\",\n      \"name\": \"Dian Wahyudi\",\n      \"firstName\": \"Dian\",\n      \"lastName\": \"Wahyudi\",\n      \"gender\": \"UNKNOWN\",\n      \"score\": 0.9,\n      \"access\": \"PUBLIC\",\n      \"enhanced\": true,\n      \"phones\": [\n        {\n          \"e164Format\": \"+6287770307854\",\n          \"numberType\": \"MOBILE\",\n          \"nationalFormat\": \"0877-7030-7854\",\n          \"dialingCode\": 62,\n          \"countryCode\": \"ID\",\n          \"carrier\": \"XL Axiata\",\n          \"type\": \"openPhone\"\n        }\n      ],\n      \"addresses\": [\n        {\n          \"address\": \"ID\",\n          \"countryCode\": \"ID\",\n          \"timeZone\": \"+07:00\",\n          \"type\": \"address\"\n        }\n      ],\n      \"internetAddresses\": [\n        {\n          \"id\": \"diansoft1711@gmail.com\",\n          \"service\": \"email\",\n          \"caption\": \"Dian Wahyudi\",\n          \"type\": \"internetAddress\"\n        }\n      ],\n      \"badges\": [\"verified\", \"user\"],\n      \"tags\": [],\n      \"profileEditHistory\": {},\n      \"spamInfo\": {},\n      \"cacheTtl\": 1296000,\n      \"sources\": []\n    }\n  ],\n  \"provider\": \"ss-nu\",\n  \"stats\": {\n    \"sourceStats\": []\n  }\n}\n","truecaller.json",[205,5445,5446,5450,5463,5468,5488,5506,5526,5546,5566,5582,5602,5616,5629,5634,5655,5675,5695,5711,5730,5749,5766,5771,5776,5789,5793,5811,5829,5849,5865,5869,5873,5886,5890,5908,5928,5947,5964,5968,5972,6006,6020,6034,6047,6063,6077,6082,6087,6107,6120,6133,6137],{"__ignoreMap":249},[42,5447,5448],{"class":254,"line":255},[42,5449,259],{"class":258},[42,5451,5452,5454,5457,5459,5461],{"class":254,"line":262},[42,5453,265],{"class":258},[42,5455,5456],{"class":268},"data",[42,5458,272],{"class":258},[42,5460,275],{"class":258},[42,5462,580],{"class":258},[42,5464,5465],{"class":254,"line":289},[42,5466,5467],{"class":258},"    {\n",[42,5469,5470,5473,5475,5477,5479,5481,5484,5486],{"class":254,"line":310},[42,5471,5472],{"class":258},"      \"",[42,5474,788],{"class":534},[42,5476,272],{"class":258},[42,5478,275],{"class":258},[42,5480,278],{"class":258},[42,5482,5483],{"class":281},"lB3vOHRxq8Ek9wc30h2uIA==",[42,5485,272],{"class":258},[42,5487,286],{"class":258},[42,5489,5490,5492,5494,5496,5498,5500,5502,5504],{"class":254,"line":331},[42,5491,5472],{"class":258},[42,5493,615],{"class":534},[42,5495,272],{"class":258},[42,5497,275],{"class":258},[42,5499,278],{"class":258},[42,5501,5008],{"class":281},[42,5503,272],{"class":258},[42,5505,286],{"class":258},[42,5507,5508,5510,5513,5515,5517,5519,5522,5524],{"class":254,"line":352},[42,5509,5472],{"class":258},[42,5511,5512],{"class":534},"firstName",[42,5514,272],{"class":258},[42,5516,275],{"class":258},[42,5518,278],{"class":258},[42,5520,5521],{"class":281},"Dian",[42,5523,272],{"class":258},[42,5525,286],{"class":258},[42,5527,5528,5530,5533,5535,5537,5539,5542,5544],{"class":254,"line":373},[42,5529,5472],{"class":258},[42,5531,5532],{"class":534},"lastName",[42,5534,272],{"class":258},[42,5536,275],{"class":258},[42,5538,278],{"class":258},[42,5540,5541],{"class":281},"Wahyudi",[42,5543,272],{"class":258},[42,5545,286],{"class":258},[42,5547,5548,5550,5553,5555,5557,5559,5562,5564],{"class":254,"line":394},[42,5549,5472],{"class":258},[42,5551,5552],{"class":534},"gender",[42,5554,272],{"class":258},[42,5556,275],{"class":258},[42,5558,278],{"class":258},[42,5560,5561],{"class":281},"UNKNOWN",[42,5563,272],{"class":258},[42,5565,286],{"class":258},[42,5567,5568,5570,5573,5575,5577,5580],{"class":254,"line":415},[42,5569,5472],{"class":258},[42,5571,5572],{"class":534},"score",[42,5574,272],{"class":258},[42,5576,275],{"class":258},[42,5578,5579],{"class":490}," 0.9",[42,5581,286],{"class":258},[42,5583,5584,5586,5589,5591,5593,5595,5598,5600],{"class":254,"line":436},[42,5585,5472],{"class":258},[42,5587,5588],{"class":534},"access",[42,5590,272],{"class":258},[42,5592,275],{"class":258},[42,5594,278],{"class":258},[42,5596,5597],{"class":281},"PUBLIC",[42,5599,272],{"class":258},[42,5601,286],{"class":258},[42,5603,5604,5606,5609,5611,5613],{"class":254,"line":457},[42,5605,5472],{"class":258},[42,5607,5608],{"class":534},"enhanced",[42,5610,272],{"class":258},[42,5612,275],{"class":258},[42,5614,5615],{"class":258}," true,\n",[42,5617,5618,5620,5623,5625,5627],{"class":254,"line":478},[42,5619,5472],{"class":258},[42,5621,5622],{"class":534},"phones",[42,5624,272],{"class":258},[42,5626,275],{"class":258},[42,5628,580],{"class":258},[42,5630,5631],{"class":254,"line":496},[42,5632,5633],{"class":258},"        {\n",[42,5635,5636,5639,5642,5644,5646,5648,5651,5653],{"class":254,"line":513},[42,5637,5638],{"class":258},"          \"",[42,5640,5641],{"class":490},"e164Format",[42,5643,272],{"class":258},[42,5645,275],{"class":258},[42,5647,278],{"class":258},[42,5649,5650],{"class":281},"+6287770307854",[42,5652,272],{"class":258},[42,5654,286],{"class":258},[42,5656,5657,5659,5662,5664,5666,5668,5671,5673],{"class":254,"line":528},[42,5658,5638],{"class":258},[42,5660,5661],{"class":490},"numberType",[42,5663,272],{"class":258},[42,5665,275],{"class":258},[42,5667,278],{"class":258},[42,5669,5670],{"class":281},"MOBILE",[42,5672,272],{"class":258},[42,5674,286],{"class":258},[42,5676,5677,5679,5682,5684,5686,5688,5691,5693],{"class":254,"line":547},[42,5678,5638],{"class":258},[42,5680,5681],{"class":490},"nationalFormat",[42,5683,272],{"class":258},[42,5685,275],{"class":258},[42,5687,278],{"class":258},[42,5689,5690],{"class":281},"0877-7030-7854",[42,5692,272],{"class":258},[42,5694,286],{"class":258},[42,5696,5697,5699,5702,5704,5706,5709],{"class":254,"line":568},[42,5698,5638],{"class":258},[42,5700,5701],{"class":490},"dialingCode",[42,5703,272],{"class":258},[42,5705,275],{"class":258},[42,5707,5708],{"class":490}," 62",[42,5710,286],{"class":258},[42,5712,5713,5715,5718,5720,5722,5724,5726,5728],{"class":254,"line":583},[42,5714,5638],{"class":258},[42,5716,5717],{"class":490},"countryCode",[42,5719,272],{"class":258},[42,5721,275],{"class":258},[42,5723,278],{"class":258},[42,5725,4916],{"class":281},[42,5727,272],{"class":258},[42,5729,286],{"class":258},[42,5731,5732,5734,5736,5738,5740,5742,5745,5747],{"class":254,"line":589},[42,5733,5638],{"class":258},[42,5735,5433],{"class":490},[42,5737,272],{"class":258},[42,5739,275],{"class":258},[42,5741,278],{"class":258},[42,5743,5744],{"class":281},"XL Axiata",[42,5746,272],{"class":258},[42,5748,286],{"class":258},[42,5750,5751,5753,5755,5757,5759,5761,5764],{"class":254,"line":610},[42,5752,5638],{"class":258},[42,5754,294],{"class":490},[42,5756,272],{"class":258},[42,5758,275],{"class":258},[42,5760,278],{"class":258},[42,5762,5763],{"class":281},"openPhone",[42,5765,648],{"class":258},[42,5767,5768],{"class":254,"line":631},[42,5769,5770],{"class":258},"        }\n",[42,5772,5773],{"class":254,"line":651},[42,5774,5775],{"class":258},"      ],\n",[42,5777,5778,5780,5783,5785,5787],{"class":254,"line":657},[42,5779,5472],{"class":258},[42,5781,5782],{"class":534},"addresses",[42,5784,272],{"class":258},[42,5786,275],{"class":258},[42,5788,580],{"class":258},[42,5790,5791],{"class":254,"line":663},[42,5792,5633],{"class":258},[42,5794,5795,5797,5799,5801,5803,5805,5807,5809],{"class":254,"line":684},[42,5796,5638],{"class":258},[42,5798,4831],{"class":490},[42,5800,272],{"class":258},[42,5802,275],{"class":258},[42,5804,278],{"class":258},[42,5806,4916],{"class":281},[42,5808,272],{"class":258},[42,5810,286],{"class":258},[42,5812,5813,5815,5817,5819,5821,5823,5825,5827],{"class":254,"line":706},[42,5814,5638],{"class":258},[42,5816,5717],{"class":490},[42,5818,272],{"class":258},[42,5820,275],{"class":258},[42,5822,278],{"class":258},[42,5824,4916],{"class":281},[42,5826,272],{"class":258},[42,5828,286],{"class":258},[42,5830,5831,5833,5836,5838,5840,5842,5845,5847],{"class":254,"line":727},[42,5832,5638],{"class":258},[42,5834,5835],{"class":490},"timeZone",[42,5837,272],{"class":258},[42,5839,275],{"class":258},[42,5841,278],{"class":258},[42,5843,5844],{"class":281},"+07:00",[42,5846,272],{"class":258},[42,5848,286],{"class":258},[42,5850,5851,5853,5855,5857,5859,5861,5863],{"class":254,"line":748},[42,5852,5638],{"class":258},[42,5854,294],{"class":490},[42,5856,272],{"class":258},[42,5858,275],{"class":258},[42,5860,278],{"class":258},[42,5862,4831],{"class":281},[42,5864,648],{"class":258},[42,5866,5867],{"class":254,"line":763},[42,5868,5770],{"class":258},[42,5870,5871],{"class":254,"line":769},[42,5872,5775],{"class":258},[42,5874,5875,5877,5880,5882,5884],{"class":254,"line":783},[42,5876,5472],{"class":258},[42,5878,5879],{"class":534},"internetAddresses",[42,5881,272],{"class":258},[42,5883,275],{"class":258},[42,5885,580],{"class":258},[42,5887,5888],{"class":254,"line":804},[42,5889,5633],{"class":258},[42,5891,5892,5894,5896,5898,5900,5902,5904,5906],{"class":254,"line":825},[42,5893,5638],{"class":258},[42,5895,788],{"class":490},[42,5897,272],{"class":258},[42,5899,275],{"class":258},[42,5901,278],{"class":258},[42,5903,5375],{"class":281},[42,5905,272],{"class":258},[42,5907,286],{"class":258},[42,5909,5910,5912,5915,5917,5919,5921,5924,5926],{"class":254,"line":842},[42,5911,5638],{"class":258},[42,5913,5914],{"class":490},"service",[42,5916,272],{"class":258},[42,5918,275],{"class":258},[42,5920,278],{"class":258},[42,5922,5923],{"class":281},"email",[42,5925,272],{"class":258},[42,5927,286],{"class":258},[42,5929,5930,5932,5935,5937,5939,5941,5943,5945],{"class":254,"line":862},[42,5931,5638],{"class":258},[42,5933,5934],{"class":490},"caption",[42,5936,272],{"class":258},[42,5938,275],{"class":258},[42,5940,278],{"class":258},[42,5942,5008],{"class":281},[42,5944,272],{"class":258},[42,5946,286],{"class":258},[42,5948,5949,5951,5953,5955,5957,5959,5962],{"class":254,"line":876},[42,5950,5638],{"class":258},[42,5952,294],{"class":490},[42,5954,272],{"class":258},[42,5956,275],{"class":258},[42,5958,278],{"class":258},[42,5960,5961],{"class":281},"internetAddress",[42,5963,648],{"class":258},[42,5965,5966],{"class":254,"line":881},[42,5967,5770],{"class":258},[42,5969,5970],{"class":254,"line":895},[42,5971,5775],{"class":258},[42,5973,5974,5976,5979,5981,5983,5986,5988,5991,5993,5996,5998,6001,6003],{"class":254,"line":915},[42,5975,5472],{"class":258},[42,5977,5978],{"class":534},"badges",[42,5980,272],{"class":258},[42,5982,275],{"class":258},[42,5984,5985],{"class":258}," [",[42,5987,272],{"class":258},[42,5989,5990],{"class":281},"verified",[42,5992,272],{"class":258},[42,5994,5995],{"class":258},",",[42,5997,278],{"class":258},[42,5999,6000],{"class":281},"user",[42,6002,272],{"class":258},[42,6004,6005],{"class":258},"],\n",[42,6007,6008,6010,6013,6015,6017],{"class":254,"line":935},[42,6009,5472],{"class":258},[42,6011,6012],{"class":534},"tags",[42,6014,272],{"class":258},[42,6016,275],{"class":258},[42,6018,6019],{"class":258}," [],\n",[42,6021,6022,6024,6027,6029,6031],{"class":254,"line":956},[42,6023,5472],{"class":258},[42,6025,6026],{"class":534},"profileEditHistory",[42,6028,272],{"class":258},[42,6030,275],{"class":258},[42,6032,6033],{"class":258}," {},\n",[42,6035,6036,6038,6041,6043,6045],{"class":254,"line":977},[42,6037,5472],{"class":258},[42,6039,6040],{"class":534},"spamInfo",[42,6042,272],{"class":258},[42,6044,275],{"class":258},[42,6046,6033],{"class":258},[42,6048,6049,6051,6054,6056,6058,6061],{"class":254,"line":995},[42,6050,5472],{"class":258},[42,6052,6053],{"class":534},"cacheTtl",[42,6055,272],{"class":258},[42,6057,275],{"class":258},[42,6059,6060],{"class":490}," 1296000",[42,6062,286],{"class":258},[42,6064,6065,6067,6070,6072,6074],{"class":254,"line":1000},[42,6066,5472],{"class":258},[42,6068,6069],{"class":534},"sources",[42,6071,272],{"class":258},[42,6073,275],{"class":258},[42,6075,6076],{"class":258}," []\n",[42,6078,6079],{"class":254,"line":1014},[42,6080,6081],{"class":258},"    }\n",[42,6083,6084],{"class":254,"line":1031},[42,6085,6086],{"class":258},"  ],\n",[42,6088,6089,6091,6094,6096,6098,6100,6103,6105],{"class":254,"line":1050},[42,6090,265],{"class":258},[42,6092,6093],{"class":268},"provider",[42,6095,272],{"class":258},[42,6097,275],{"class":258},[42,6099,278],{"class":258},[42,6101,6102],{"class":281},"ss-nu",[42,6104,272],{"class":258},[42,6106,286],{"class":258},[42,6108,6109,6111,6114,6116,6118],{"class":254,"line":1056},[42,6110,265],{"class":258},[42,6112,6113],{"class":268},"stats",[42,6115,272],{"class":258},[42,6117,275],{"class":258},[42,6119,525],{"class":258},[42,6121,6122,6124,6127,6129,6131],{"class":254,"line":1732},[42,6123,531],{"class":258},[42,6125,6126],{"class":534},"sourceStats",[42,6128,272],{"class":258},[42,6130,275],{"class":258},[42,6132,6076],{"class":258},[42,6134,6135],{"class":254,"line":1752},[42,6136,1053],{"class":258},[42,6138,6139],{"class":254,"line":1772},[42,6140,1059],{"class":258},[17,6142,6143,6144,6149,6150,6152,6153,6158,6159,6162,6163,6166,6167,34],{},"A ",[23,6145,6148],{"href":6146,"rel":6147},"https:\u002F\u002Fwww.spokeo.com",[27],"Spokeo"," search for his email (",[205,6151,5375],{},") provides us his ",[23,6154,6157],{"href":6155,"rel":6156},"https:\u002F\u002Fwww.pinterest.com\u002Fdiansoft1711",[27],"Pinterest profile",", but that is not much because his profile is empty. We can notice another pattern here, his profile name on Pinterest is ",[205,6160,6161],{},"diansoft1711",", on Facebook it's ",[205,6164,6165],{},"Slikeye",", and on Twitter and Instagram is ",[205,6168,6169],{},"dianwhyd",[17,6171,6172,6173,34],{},"I think we need to search for more Social Networks profiles for his usernames. There're tools to help us do it, like ",[23,6174,6177],{"href":6175,"rel":6176},"https:\u002F\u002Fgithub.com\u002Fthelinuxchoice\u002Fuserrecon",[27],"userrecon",[189,6179,6180,6185,6196],{},[192,6181,6182,6184],{},[205,6183,6161],{}," username didn't find any new profiles (it found only Pinterest).",[192,6186,6187,6189,6190,6195],{},[205,6188,6165],{}," username got us a ",[23,6191,6194],{"href":6192,"rel":6193},"https:\u002F\u002Fbitbucket.org\u002FSlikeye",[27],"BitBucket profile"," (without any repos, or all of them are private).",[192,6197,6198,6200,6201,6205,6206,6211,6212,34],{},[205,6199,6169],{}," username provides us with a different ",[23,6202,6157],{"href":6203,"rel":6204},"https:\u002F\u002Fwww.pinterest.com\u002Fdianwhyd",[27],", a ",[23,6207,6210],{"href":6208,"rel":6209},"https:\u002F\u002Fflipboard.com\u002F@DianWhy",[27],"Flipboard profile",", and a ",[23,6213,6216],{"href":6214,"rel":6215},"https:\u002F\u002Fwww.tripadvisor.com\u002FProfile\u002FDianwhyd",[27],"Tripadvisor profile",[17,6218,6219,6220,6222,6223,6228,6229,6232],{},"If we're already here, let's search for his username in the Canva database leak (",[205,6221,5005],{},") with our new tool. This search gives us interesting results - a different ",[23,6224,6227],{"href":6225,"rel":6226},"https:\u002F\u002Fwww.facebook.com\u002Fslikeye1711",[27],"Facebook profile",", it looks like someone else, but he's also from ",[31,6230,6231],{},"\"Bogor, Indonesia\"",". He says on his profile he works at Apple (and it takes me straight into the Pastebin account with the Apple scam page), but he has an Apple advertisement photo on the cover page. The thing is, when I open it up to see it in full size you can actually see it's a screenshot of apple website!",[17,6234,6235],{},[2439,6236],{"alt":6237,"className":6238,"src":6239},"Agustinus Rivaldo Facebook Cover Image",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fagustinus-rivaldo-facebook-cover.webp",[17,6241,6242,6243,6246,6247,6252],{},"Or is it? When you look closer on the URL of the page it's ",[205,6244,6245],{},"http:\u002F\u002Fapps-icloudapps.serveirc.com"," which is not Apples one. This is a scam \u002F phishing page to login with your apple credentials. Other stuff we see on the screenshot is that the web browser is Chrome, it's a Windows 10 OS on a laptop, and he has a bunch of other tabs open (Facebook, a cPanels, and some other stuff I don't recognize), and he has a ",[23,6248,6251],{"href":6249,"rel":6250},"https:\u002F\u002Fwww.sublimetext.com",[27],"sublime text editor"," window minimized.",[17,6254,6255,6256,6258],{},"This doesn't look good for our guy, this is probably a fake account for an apple scam \u002F phishing. When I search for ",[205,6257,6245],{}," in Google all the results are about scam stuff (news articles, forums, etc). This is probably our guy or some other man in the phishing operation he belongs to.",[17,6260,6261,6262,6265,6266,6269],{},"The next step is to search for more information about those phishing sites. The search for ",[205,6263,6264],{},"*.bocah.team"," on Google results in couple of new emails and websites, but we have enough of that, let's search specific for Pastebin, because that's where we find the apple scam page with his email and Facebook profile URL. So when I searched ",[205,6267,6268],{},"*.bocah.team site:pastebin.com"," I found 4 different pastes:",[189,6271,6272,6286,6303,6311],{},[192,6273,214,6274,6279,6280,6285],{},[23,6275,6278],{"href":6276,"rel":6277},"https:\u002F\u002Fpastebin.com\u002FT6bnuqze",[27],"first"," from profile named ",[23,6281,6284],{"href":6282,"rel":6283},"https:\u002F\u002Fpastebin.com\u002Fu\u002Faridho",[27],"ARIDHO",", that have a lot of phishing pastes in his profile.",[192,6287,214,6288,6293,6294,6299,6300,34],{},[23,6289,6292],{"href":6290,"rel":6291},"https:\u002F\u002Fpastebin.com\u002FXmEBg6vF",[27],"second"," from a profile named ",[23,6295,6298],{"href":6296,"rel":6297},"https:\u002F\u002Fpastebin.com\u002Fu\u002Frizkyibeng",[27],"RIZKYIBENG"," and all of his pastes are Apple scam page, except for one, where he has a gmail address ",[205,6301,6302],{},"ibengrizky01@gmail.com",[192,6304,214,6305,6310],{},[23,6306,6309],{"href":6307,"rel":6308},"https:\u002F\u002Fpastebin.com\u002F3MZySMy1",[27],"third"," is a guest, and there is nothing interesting in the paste.",[192,6312,214,6313,6318],{},[23,6314,6317],{"href":6315,"rel":6316},"https:\u002F\u002Fpastebin.com\u002FC11evf9P",[27],"fourth"," is also a guest, and there is also nothing interesting in his paste.",[17,6320,6321,6322,6324,6325,6327],{},"Now, we can go search about ",[205,6323,6298],{}," with his email ",[205,6326,6302],{},", but it is out of scope right now. He can be a member of this phishing operation and maybe he isn't, and just doing those stuff alone, either way it's not an interest for me right now.",[17,6329,6330,6331,6333,6334,4233],{},"But the stuff I started to notice is that all of those scam \u002F phishing pages look the same. For example here is the slikeye panel of our target, and ",[205,6332,6284],{}," Apple scam panel (rendered with ",[23,6335,6338],{"href":6336,"rel":6337},"https:\u002F\u002Fjsfiddle.net",[27],"jsfiddle",[17,6340,6341],{},[2439,6342],{"alt":6343,"className":6344,"src":6345},"Silkeye Panel",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fsilkeye-panel.webp",[17,6347,6348],{},[2439,6349],{"alt":6350,"className":6351,"src":6352},"Aridho Panel",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Faridho-panel.webp",[17,6354,6355,6356,6358],{},"I think we got enough of this, this is for sure a scam \u002F phishing operation and our target is one of this group. So, the last thing I want to do is to search for the new email we found (",[205,6357,5375],{},") let's see if this email has been in a leak.",[17,6360,6361],{},[2439,6362],{"alt":6363,"className":6364,"src":6365},"Have I Been Pwned Report",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fhaveibeenpwned-second-report.webp",[17,6367,6368,6369,6372],{},"It has, so it's time to search for the Bukalapak leaked database. This one wasn't as easy as the ",[205,6370,6371],{},"Canva"," one. But I managed to find it. And our new email target is in there.",[74,6374,6375,6398],{},[77,6376,6377],{},[80,6378,6379,6382,6384,6387,6389,6392,6395],{},[83,6380,6381],{},"Uid",[83,6383,85],{},[83,6385,6386],{},"Full Name",[83,6388,88],{},[83,6390,6391],{},"Salt",[83,6393,6394],{},"Username",[83,6396,6397],{},"Birthday",[102,6399,6400],{},[80,6401,6402,6405,6410,6413,6416,6419,6421],{},[107,6403,6404],{},"47241282",[107,6406,6407],{},[23,6408,5375],{"href":6409},"mailto:diansoft1711@gmail.com",[107,6411,6412],{},"Andi",[107,6414,6415],{},"$2a$10$T12OFkTmziUovvADLb7koeAd4VODsOkjEECOftIb5fy4UIaE3f7C2",[107,6417,6418],{},"C1LyhB6B52CIjwEv3AMR",[107,6420,6161],{},[107,6422],{},[17,6424,6425,6426,6429,6430,6432,6433,4355,6435,6438,6439,6442,6443,6445,6446,6451],{},"We can see he have a different ",[205,6427,6428],{},"fullname"," here (",[205,6431,6412],{},"). And we manage to get his ",[205,6434,4906],{},[205,6436,6437],{},"salt",". We don't even need to use tools to identify the hash type, from the news out there we know it's a ",[205,6440,6441],{},"bcrypt",", and we see in the database we have a ",[205,6444,6437],{},". We can use ",[23,6447,6450],{"href":6448,"rel":6449},"https:\u002F\u002Fhashcat.net\u002Fhashcat",[27],"hashcat"," and try to crack it, but this is my red line, I don't think the guy tried to hack my service.",[60,6453,6455],{"id":6454},"_7-quick-mentions","7. Quick Mentions",[17,6457,6458],{},"Before I wrap this up, I just want to quickly mention a couple of tools I use all the time, but in this case wasn't any help (or other tools get more data), and I just didn't mention them in the write up.",[17,6460,6461,6462,6467],{},"So the first one is ",[23,6463,6466],{"href":6464,"rel":6465},"https:\u002F\u002Fgithub.com\u002Faboul3la\u002FSublist3r",[27],"sublist3r",", it gave me some subdomains (but DNSscan found more, much more! subdomains (and much faster)).",[17,6469,6470],{},[2439,6471],{"alt":6472,"className":6473,"src":6474},"sublist3r Results",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fsublist3r-results.webp",[17,6476,6477,6478,6483,6484,6487,6488,6492],{},"Another tool I always use is ",[23,6479,6482],{"href":6480,"rel":6481},"https:\u002F\u002Fgithub.com\u002Flaramies\u002FtheHarvester",[27],"theHarvester",". The Harvester found the ",[205,6485,6486],{},"johnny_pacocha"," email which led us to his Pastebin and then his Facebook profile page. But to be truthful this is not the first way I found this email, so I include the original way (with ",[23,6489,4509],{"href":6490,"rel":6491},"https:\u002F\u002Fhunter.io",[27],"). But, if I didn't have an account there, or hunter wasn't able to find it, I probably would've been able to find it with theHarvester.",[17,6494,6495],{},[2439,6496],{"alt":6497,"className":6498,"src":6499},"The Harvester Report",[2443,2444],"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002FtheHarvester-yahoo.webp",[60,6501,6503],{"id":6502},"_8-summary","8. Summary",[17,6505,6506],{},"So, to recap our trip, we started with just 2 email addresses from the same domain and 2 IPs. We managed to probably find our guy and determine he is a member in a scam \u002F phishing operation. We found more people from this operation but didn't continue to investigate them. But the most important thing, the final verdict is that no one was trying to hack my service at work. He probably did some scanning and encountered my client app, he tried to enter but quickly noticed the security protections or just simply gave up because he didn't think there is anything important there and it's not worth the trouble and time (he also stopped trying after the 4 attempts).",[17,6508,6509],{},"The other thing we gain in this reconnaissance (apart from the final verdict), is a lot of fun time and some brushing off of old rust. I hope you learned something new or that I just piqued your interest. This world is really big, there are a lot of tools that I didn't use here and there are a lot of cool people that do cool stuff and find really inventive ways to investigate.",[6511,6512,6513],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":249,"searchDepth":262,"depth":262,"links":6515},[6516,6517,6518,6519,6520,6521,6522,6523],{"id":62,"depth":262,"text":63},{"id":221,"depth":262,"text":222},{"id":4261,"depth":262,"text":4262},{"id":4497,"depth":262,"text":4498},{"id":4669,"depth":262,"text":4670},{"id":5426,"depth":262,"text":5427},{"id":6454,"depth":262,"text":6455},{"id":6502,"depth":262,"text":6503},"2020-06-01","A hands-on walkthrough of passive reconnaissance and OSINT techniques.",false,"md",{"src":6529},"\u002Fposts\u002F2020\u002Fopen-source-intelligence\u002Fosint-cover.webp",{},true,"\u002Fblog\u002F2020\u002Fopen-source-intelligence",{"title":5,"description":6525},"blog\u002F2020\u002Fopen-source-intelligence","_z59ywl7_EfU9htOFFllPMPYV8EO5gGFttgEGTlT258",[6537,6542],{"title":6538,"path":6539,"stem":6540,"description":6541,"children":-1},"New design for the blog!","\u002Fblog\u002F2020\u002Fnew-design-for-the-blog","blog\u002F2020\u002Fnew-design-for-the-blog","Unveiling the blog's fifth redesign, with dark mode and privacy-friendly tooling.",{"title":6543,"path":6544,"stem":6545,"description":6546,"children":-1},"Releasing Software Is Hard! Is it?","\u002Fblog\u002F2020\u002Freleasing-software-is-hard","blog\u002F2020\u002Freleasing-software-is-hard","Automating versioning and releases with Semantic Versioning and semantic-release.",1786001638688]