Preventing Social Engineering & Phishing: Advanced Spear-Phishing Reconnaissance
How cybercriminals leverage open-source intelligence for spear-phishing. Detecting typosquatting, lookalike domains, and defensive employee reflexes.
Adversaries perform extensive open-source reconnaissance before launching targeted corporate spear-phishing campaigns. Proactive threat hunting stops these vectors before malicious payloads enter perimeter mailboxes.
Detection Vectors
- Analyze typosquatting permutations and newly registered lookalike domains.
- Monitor Certificate Transparency (CT) logs for unapproved SSL certificates issued for corporate brand names.
- Cross-examine MX records and email routing security mechanisms (SPF, DKIM, DMARC alignment).
Frequently Asked Questions
What is spear-phishing?
A tailored social engineering attack where adversaries research the victim's colleagues, vendors, and role to craft convincing fraudulent requests.
How can lookalike domains be detected?
By inspecting domain registration age (WHOIS), punycode homographs, certificate transparency logs, and DNS infrastructure.
How does OSINT support phishing defense?
Organizations monitor lookalike domain registrations and compromised credentials to block phishing vectors before employees interact with them.