Name: Illicit Network Mapping: Using Data Pivots to Develop Illicit Connections
Uploaded: 2026-05-28T18:16:22.674Z
Duration: 1 h 43 min 52 s
Description: Illicit Network Mapping: Using Data Pivots to Develop Illicit Connections

Transcript for "Illicit Network Mapping: Using Data Pivots to Develop Illicit Connections": Hi, everyone. We are just gonna give it another couple of, maybe a minute or so just to let everyone else join. So just bear with us. Another thirty seconds or so or so. That's a good start. And I will we will start. Just let everyone know that the the event, sorry, the training is being recorded, and it will also be available, on Discord. So anyone anyone who wants to catch up with things later or you miss anything, don't worry about it. It it is available 201, through there. So we'll just give it another thirty seconds or so just to see if there's any late joiners, and then we will then we will begin. Okay. Welcome to the Flare Academy, training on investigations. Today, we're gonna look at, illicit network mapping. With the illicit network mapping, we're gonna be focusing mostly on the domain name system or DNS, looking at some of the available data points, the available information, that you can determine from DNS, during an investigation. We're not gonna pick on a particular investigation. We have some examples to go through, where we will focus on specific data areas and what information can be gleaned from there. And, also, we'll step into some of the visual evidence that's available, you know, looking at the websites themselves, looking at source code, you know, picking out interesting pieces of information from, the the sites themselves. So, assuming that everyone is good to go and, we can kick off, then, I will begin. So what we're aiming to cover in the next ninety minutes is several different areas. We're gonna look at some of the foundations. We're gonna look at some of the methodology. We're gonna look at the limits of who is we're gonna, touch upon who is, the type of information that used to be available and is now currently available. We're gonna look at passive DNS as a utilization tool. Passive DNS is an absolute gold mine of data and information, but only if you know where to look and know what to to look for. We're gonna look at the case studies. We're gonna go through a botnet investigation, where it pivoted off into a, believe it or not, a hair wig pivot, which is kinda curious. We're gonna be looking at toll scams, some of the DGAs, the domain generation algorithms that are behind those, SIM farms and phishing, and actually the cash out. So we're gonna go through an entire process there of, how how that entire scheme, is currently working. I'm gonna assume that everyone has received a text message, at some point, saying that you have an overdue toll fine of some kind. We're gonna go through that entire process. And then we're gonna go through, something a bit more current, in terms of brand replicas, event driven activity involving domains, websites, and and so on, and then what the mapping actually delivers. So, we're gonna touch upon all this. We'll go into a bit more detail, in some areas. There is a q and a function, available. We'll take the questions at the end mostly because I can't actually see the questions whilst I'm presenting. But if there is a really good question, I have asked for to be interrupted. And then, we will, and then there is a handout at the end or a downloadable at the end, I should rather say, which is basically a crib sheet or a summary of this actual, academy training. It covers the bullet points and some of the main areas, as a refresher item so you can actually, pull that at the end. There will be a couple of, surveys popping up. I think they're towards the end as well. Feel free to to obviously engage with those. And then as I said right at the very beginning, there is the Discord channel available as well. So if there's any questions that you have, that come to mind after the presentation and you missed the q and a, don't worry. Jump in the Discord. Ask the questions in the Discord, and I will be, happy to respond to any of those. And if I can't answer them, I know somebody else actually will. So we're gonna start with the foundations, and how the digital and the visual evidence works together. Hey, And. yeah. Sorry. Sorry. Jumping in real quick, Joe. Joe here. Can you pop pop it into full screen by chance? The I don't even have that option. slides? Interesting. Like, it's probably because it's PDF. This this is PowerPoint, so it's full sorry, everyone. It's full screen on my screen. So Okay. Let me see the borders. It's all good. okay. Sorry about that. Where was I? Oh, yes. So, this is the first step of, where a lot of investigations, start to maybe fall away in terms of the, evidence gathering, the data gathering processes. Because if you look at either alone, potentially you're missing, data from the other set, which may be critical or crucial to your investigation, whatever you might well be investigating. So if you're looking at just the websites themselves, there's a whole treasure trove of DNS based information, behind the scenes, which may lead you or point you towards different directions, bigger groups, a larger network, or or, some other kind of investigation avenue. One thing that I always personally say is it's never just one website. So if you are looking at a website, then potentially there is two, three, five, ten, fifty, a 100,000 websites associated with it. But if you're just looking at the DNS component and you're not necessarily looking at the website themselves, there's a treasure trove of information on the website, which you may be dismissing, because it's, obviously fraudulent. It's obviously fake. It's obviously, miss misconfigured. Typos are a fantastic, data point to to resource because they're a unique indicator. Phone numbers, ZIP codes, addresses, even if they are fake, they all become unique indicators in the right context. And that's something that, we will use throughout or I'll be using throughout this. It's it's the context and how you use that information. Standalone, it may be, non evidential. But if you combine it with two or three other pieces of information, suddenly becomes a very, very strong indicator of, malicious or bad activity. So if we look at layer one, which is a digital area and some of its components, this is really where you're you're starting to look at, confidence levels. So we have things like IP addresses. IP addresses are can be a fantastic information gathering, data point, but they can also be a point where you are led down a path where you didn't necessarily have to to go. And this is really understanding how the various different IP addresses work and how the IP addresses with the registrars and which providers work. For example, if I see an IP address that's associated with Cloudflare, I'm not necessarily gonna spend a lot of time pulling off every single domain associated with that particular IP address because I know that Cloudflare, as a hosting service, will have maybe hundreds of thousands of domains on a single IP address. In the flip side, if I see an IP address, and there's only, say, five domains on that IP address, then I have a higher certainty or a higher higher up or better idea that the domains that are on that IP address maybe are related to each other because it's such a small cluster of domains. That potentially means that somebody has spent maybe some extra cash to have a dedicated IP address associated to their brand, their platform, their domain names. So, therefore, we're not necessarily going to see a lot of false positives, from, you know, unconnected domains in that IP space. Of course, you still need to build that out as an evidential package. You still need to verify this information. But as a general rule of thumb, if you see five or less domains on an IP address, you can be reasonably certain that they are all linked. 10 to 15 domains on an IP address, then most of them are gonna be linked, but you may have to work a little bit harder maybe to make that evidential link. 15 to fifty, twenty, 30 domains, then you're getting into the possibility that, it's a shared hosting service, and there'll be domains on there that are not connected to maybe the investigation or the research you do that you're doing. You know, once you get a start getting above 50 or so domains on a single IP address, and there's no obvious connection from other data points, it really then starts becoming how much time do you want to spend researching them, to find that link on you know, there is probably links in there, but you're gonna be spending more time. A better, link, for example, or a better data point might be the start of authority address or even, the mail server or the name server. Now start of authority address or SOA, when you're registering a domain is another data point which is not often, utilized during investigations. When you're registering a domain for the first time, you and if those of you who have done this, you get to put an email address in there with your name and your contact details, etcetera, etcetera. This is not information necessarily that's gonna go on to, the who is record. You can change that, as a later date. Soon as that record goes live, you can change that information. You can put another email address in there. You can go private. It's entirely up to you. But that SOA email address is recorded for all time. So it becomes a searchable pivot point, if that information is available to you and if it if it's not masked, that that email address that's entered in there could be a unique indicator, which links you to, again, groups of domain names elsewhere. Mail servers is another, very good indicator of, managed infrastructure. You get the option of signing up to the generic, registrar's hosting mail server, which is not necessarily a unique indicator. You could be on that mail server, with hundreds of thousands of other users within that service. However, if I want to import or buy a mail service specifically for my brand, I can do that. I simply point that at my domain, and away you away you go. Once you start looking? at the data, you yes. Sorry. Hi, Sorry. Joe. I I don't think the slides are moving on our end. They have happy haven't moved yet. oh, I haven't moved. yet. Okay. No. I'm just going through this page here. Paid. You're on slide three? Yes. Okay. I'm gonna go backstage then. Thanks. Sorry. No worries. So yeah. So if you have a mail server and it's unique to your brand or your, your particular, company, you can, you can point all your domains at that mail server. The same operation can work with a lot of criminal, illicit enterprises for ease of their management. They will point all their illicit domains to a mail server, that they are operating and they are maintaining. Again, it's a it's a pivot point. It's a data point which you can you can search, specifically and bring back all the domains associated with a name server, rather than trying to search for individual domains. And layer two, the visual pieces, we touched upon spelling mistakes. Spelling mistakes themselves are very unique indicators. Look for spaces in between periods. Look for misspelled words. Look for different spelling, conventions within words. Are they using a zed instead of an s? Are they using an s instead of a zed? And so on. Identical product descriptions, some of those are cut and paste, but some of those are specific, especially when you're looking at, fake investment scams, for example. They will cut and paste the same wording over and over again, through the various, iterations of their particular websites. Google Analytics IDs are a fantastic resource to look for. You can get those from the source code of a particular website. Again, it's an indication that, websites or the domains are being managed by a central entity. And, obviously, it's then up to you to prove, you know, linkage through other sources. And we'll touch upon tierless certificates and template structure and, payment structures, later on. Moving the page. So organizing your data, every new field becomes a pivot. So now we're looking at, information which you can actually get from DNS queries. There are a myriad of tools and platforms out there, such as, silent push, RiskIQ still has the ability to do, DNS lookups. You have tools at your disposal. Some of them are free. Some of them, you you have to pay for. The IP addresses, email servers, phone numbers, postcodes, we can go through the whole list. If you can scrape it, add it because every field potentially becomes a future pivot. And this is something, which I can't echo enough is that investigations where, traditionally, at least pre 2016, people just looked at the who is record and took the information from the who is record. They did not take information from other sources. Those those investigations may still succeed, but you're going to miss a lot of information. So if you are using, you know, platforms, that do provide a a lot of information, a lot of data, scrape everything that you can export into XLS, use the API to export it, whatever your preference happens to be. Personally, and if you've ever received any data from from me directly, you'll know that I have 24 individual data points that I pull out information for from every single DNS record that I look at. That's me personally. You may not need to have, as many as that. It does depend on what you're looking for, but, I pull out 24 different different, pieces, and that's just on the DNS DNS side. So we'll we'll look at who is, and, I mean, those sorry. hi, I. swear I'm not moving. And we have Scott in the chat to, confirm. Okay. It's You wanna just. stop sharing for a second. We'll just Yeah. It's moving you're on file. screen. I see your mouse now. Can you stay here? Or I can stay. I'll happily stay here, but it said. it was. moving on my screen. Okay. Cool. Probably just a glitch. Thank you, Adrian. No problem. So, we'll start with start with Who is, which is the query response protocol with absolutely fundamental fun, fundamental limitations. So pre 2016, Who is records were essentially seen as the single source of all truth around the domain names. It included the names, addresses, phone numbers, and so on. And it was the responsibility of both the person registering the website and the per and the registrar owning the website to validate whether that information, was accurate and correct. There was very limited success in in that. Some put more effort into that than others. We saw, lots of, Mickey Mouse care of Disneyland, the Queen of England owning websites. Basically, any any way that a bad actor or not necessarily a bad actor, but someone who wanted to manipulate the system could figure out a way of bypassing the system. The easiest way that a lot of people found is that, it was simply just a ZIP code or postcode checker run by the registrars. So as long as the postcode or the ZIP code was accurate and correct in terms of its format, the rest of the name and the address, was kind of irrelevant. So that information, we there was a lot of records around that. A lot of those records were then immediately dismissed because the information was false and, obviously, the queen of England or the king of England, was not someone who is potentially selling fake sneakers online. But what that led to is a lot of key data points, being missed. So post 2,000, 2016 and GDPR, ICANN and the registrar's decided very much to make everything, privacy restricted in terms of the who is records. Some registrars have that as an option. Some registrars have that as as as default. So you're still seeing some information around, who is registering the website, but, again, you're we're into the scenario where it's, X Y Zed, is the name, X Y Zed is the address. There's very little validation behind that behind the scenes. But what a lot of people don't realize is that my random pressing of keys to put a name in there is a discernible pattern if I'm registering multiple websites at the same time. So do not dismiss, someone writing in quirky quirky five, six, seven, eight as that might be a pivot point later on when you're looking at data. So you're also looking at zone files. So, essentially, the data that's presented to you when you're looking at that information is a snapshot. It's a point in time snapshot. When you update the record with a change of address or change of information, that record slowly gets updated, and the historic information gets removed from this from the screen. You can do historic who is queries and and so on using whichever tools and platforms you happen to be using. But for the best for the most part, if you replace something, that information disappears. Again, this is where a lot of investigation starts to potentially fall down, especially those people who need to, obtain, subpoenas, warrants, or other, legal precedent to maybe seize, or obtain more information. Because that is a snapshot, a point in time piece of information, that point in time information is not necessarily accurate or will not necessarily be accurate at the time that they, present that warrant or, try to obtain that that, evidential standard. Zone files, and I believe this was research done by domain tools, a few years ago. Zone files on average take around seventeen hours to update. Some are quicker, Some are slower, but the average is seventeen hours. So if you're always thinking that the information you're looking just on that Who is lookup is already potentially seventeen hours out of date, and it can be anything up to around forty eight hours out of date depending on who updates that information. Using that information to gain some kind of access or gain some kind of, you know, evidence based criteria comes with risks because I could be literally changing that information on a daily or minute by minute basis, and that zone file is not going to be updated at the same speed that I am updating the information in that particular, file itself. And I've already touched upon the fact that once the record updates, the previous data is gone. Yes. There are tools and platforms that will give you that historical data, but if you're not using, maybe a full paid version or the tool or the platform you're using doesn't have that capability, then the Who is information, essentially has disappeared. Why is this important? Often, when you're looking at the historical data and the website templates are changing, from template a to template b to template c, obviously, again, from a evidence gathering perspective, you might you might be trying to, ascertain who's operating this website and that website. But if the website is changing, again, it becomes very difficult to obtain warrants and subpoenas and and and and so on because the criteria is constantly changing. With the historical who is record, you can actually show that, for all intents' purposes that the website hasn't actually changed hands during the period that the website template has changed. So if you're looking at a twelve month period and during that twelve month period, the website template has changed five times, but the historical who is data doesn't indicate a new owner. It hasn't changed registrar. The time stamps are all consecutive, and and and so on. It goes a long way to actually, indicate that the website hasn't changed hands. You're not telling anyone that this is a sole sourced in, indicator. There could be a group of people running the websites, but for all intents and purposes, the website is still in the same hands of maybe the people or the group that you're investigating. So, again, it's information gathering and a and a potentially critical data point. So I've touched upon this already. We're gonna look, or I'll go through what passive DNS essentially is, and it's an untapped gold mine. I'm sure there's a lot of people here who, work with blockchain. So think of DNS and and blockchain as very similar entities at the raw data level. At the raw data level, both are uncorrupted. They're unchangeable, and you're literally looking at the single sources of truth. Obviously, as you move up the layers, you can put in layers of, false information, high data, etcetera. But the raw data level, you're looking at, you know, what is currently going on. I've already mentioned that zone files take on average seventeen hours to update. Passive DNS is essentially the live DNS traffic. It is the it is the domain name system nodes constantly communicating to each other. So if I wanted to see where, my website that I'm currently tracking and tracing is, potentially moving to in terms of, let's say, IP addresses, also known as fast fluxing. Using passive DNS will show me every single IP address that that domain name has touched for the time period that I determined that I want to to look at. Passive DNS data has been collected since about 2010, and, commercially, it was available since about 2013. Company called Farsight, one of the first, first, sort of, companies to make that information available. There are many other companies available now providing this information. So, essentially, you're looking at the raw data. You're not looking at the who's registered a website. You're not looking at, you know, where the website is based, etcetera. You're looking at the continuous record of what is actually happening in the DNS system. And why does this matter? Well, this is the information that you will use to potentially track and trace the the websites themselves. And we'll go through an example where, you can see how this is beneficial in one of the the actual use cases. But if I am the criminal and I'm changing the location of my website on a minute by minute basis, I can document that using passive DNS data, and that goes towards gathering, my warrant, my, subpoena, or whatever it happens to be or as part of my investigation. It also starts to give build out a pattern of activity of the the other IP addresses potentially, that are being utilized by this criminal group. Remember I said that every data point becomes a data point in its own right? Well, everything it touches, becomes an IP address. On that IP address, you may find more information, and you start to see how this this pattern, starts to build. And then you look at the some of the feature comparisons. Historical data. Yeah. You don't get that historical data through a standard who is lookup. Passive DNS will give you the full timeline of activity associated with an IP address or a c name or a domain name back to whenever the first time it was ever ever seen if you obviously have access to that data. GDPR, I've touched upon GDPR right at the very beginning. General data protection, requirements regulation regulation, which is European based, but anybody who is potentially touching any European organization, then GDPR becomes applicable to them. Most registrars decided to adopt a GDPR process, hence why the Who is information is now redacted. But there's no GDPR, restrictions against the live data, the live domain name data, because you're not actually accessing any potentially personal identifying information. You're literally just looking at the raw data. You sometimes require account, with with, a Who is lookup. You're limited to the number of Who is lookups and and so on. With passive DNS, if you're tech you know, if you're if you have the ability to insert a node into the DNS system, You have the ability, in theory, to come start collecting passive DNS information at that particular point in time. You won't have historical data, but you will start collecting data from that particular moment in time. That data can be quite, voluminous, so I would caution you doing that, obviously. And, again, if you have specific ideas and specific, things that you're looking for, it might be beneficial, but there are services that can provide that for you. And then the update frequency, and this is the the important part, is that there is no delay or essentially a delay to the update. As soon as something occurs, that information is available to you. It could be in a matter of seconds, or it could be, minutes. But the important thing is there is actually no delay at all. So we're gonna start going through some of the case studies, and we'll pause and just try to explain, or we will explain, the key points in these case studies. Each one is slightly different. Each one had a different outcome. Each one has a different purpose. But the important piece is to really see how the various different data points, can be utilized within each particular study. Not every single data point is covered, in these case studies. But, again, if you're ingesting all the data or you're downloading all the data from your records, you can very quickly get to see which ones are utilized more than more than others. So in this particular one, passive DNS was a key, key indicator. It was a botnet based investigation, which was well publicized. It was well documented. However, it was very clear that the investigation itself was central centralized around, zone file based data and zone file based information. When you took the information from the published reports and the published data, it's all open source, and then broke that down in and started utilizing passive DNS, as part of your query set, a different pattern out of activity actually, emerged. And that made the, you know, the the particular group that was being investigated or is being highlighted showed that they were more expansive, in their network than was actually documented. So we're gonna go through this, step by step. So it was an international law enforcement operation, which, eventually seized control of a major botnet, which was literally, infecting hundreds of thousands of systems globally. So this is globally impactful. The botnet was used to for account takeovers and implicated in the theft of a over a $100,000,000, US. The passive DNS data, allows us to reconstruct how that infrastructure was originally linked and then, what other illicit networks shared the same same particular pivot points. So we had over 500, endpoints or 500 machines 500,000 machines, infected globally. It was multinational, and that and there was a 100,000,000 at least stolen from these these individuals. So as we mentioned before, one query starts to become many queries, and and the date and this is how the datasets expand. So on the query one, you're essentially looking at an IP address, that has a set number of, domains associated with that particular, IP address. There is five domains. As you can see, the data is actually quite old, but that's that's irrelevant. So there's five domains associated with this particular, IP address. Each one of them was obtained using, infection logs, infection records, virus total, etcetera etcetera. So a pattern is built around that particular IP address. If you did a standard lookup on that IP address, then, you the only results you would have obtained at that particular moment in time would have been these five domains, which is absolutely fine. You can work with that, and that would have then formed part of your investigation. I'm sure the next day in fact, in this example, the next day, you would have got another five domains with an IP address and another five domains with an IP address, and we just kept, you would just keep rolling on and essentially adding domains, to the takedown process. But the key indicator here is when you put those domains into passive DNS, and did a passive DNS lookup, those domains suddenly had more than one IP address. In fact, in this particular example, in this particular investigation, they were rotating IP address IP addresses every five seconds. So my individual IP lookup here, which gave me these five domains, was correct at that particular point in time. But by the time I looked at it again the next day, those IP addresses would have essentially changed again. But then what was actually occurring is the IP address was occurring every five seconds. So pulling that information, pulling that data of those those IP addresses actually then showed that in query two, domain name, the second domain name down, n j elliums.com, was actually linked to, another, IP address. Obviously, there's one changing every five seconds. But on that new IP address, there were another four domains or three domains. And then you looked at one of those domains and you saw they were fast fluxing, the IP address, so you obtained another six domains. So what was originally reported as a one to 200 size scale botnet, actually turned out to be over four and a half thousand domains and IP addresses associated with that particular botnet because of the way that the infrastructure was operating and the way that the bad guys were essentially operating that, that service. Each shared value that you found returned at least three to five new domain names and new IP addresses, and you could simply just keep building that information out as you went along. So four and a half thousand IPs and domain names is a significantly larger number, even using my math, than one to 200. But one to 200 is the actual disruption activity that occurred regarding this particular, botnet and this particular criminal enterprise. Fortunately, there were also physical arrests involved and so on, so the botnet was disrupted in other ways. But if those physical arrests had not occurred, this botnet would have simply continued, with a minor inconvenience of having a couple of 100, domain names, removed from the actual process itself. So this is just a key highlight of where passive DNS plays a crucial role in investigation and your information gathering. It provides you with that lifetime view of what the actual infrastructure is is doing. Now don't get me wrong. Sometimes when you look at a domain name and you're looking at a domain name or an IP address in passive DNS, there are no changes. It's simply just, the same IP address or the same services rotating, all the way through. That's absolutely fine as well. You're not gonna find, you know, that golden key every single time. Sometimes websites just stay on the same IP and don't do anything else other than, promote bad activity. But the important part is gathering that information to begin with so you can eliminate that from your search query process. So patterns start to emerge as new data points, are developed, and they feed back into the search. Now, I will assume that some people will be doing this manually. Some people, will have AI assisting them, or they will have, you know, something else which will help aid what they're doing. But rerunning your search queries every time that you get a new data point or once you re you believe you've exhausted all the data points currently and then rerunning your searches or rerunning your queries is a key way of, identifying then the linked data to those data points, and you can keep going and keep going and keep going until you actually exhaust all the data. But I will cover that and say you've exhausted all the data for that particular day. Tomorrow is a new day. There may be new registrations. We'll touch upon this, but when you look at the toll scam that are currently proliferating for the last couple of years, they're registering 500 domains per day. If you look at the Game Over Zoo spot net from 2033, 2014, they were registering a thousand websites per day, but only utilizing one per day as the c two. So it depends on your goals, and it depends on how much information you're willing to ingest and how much research time you're willing to put into this. But, it's the patterns that you're you're looking for. You're looking for, multiple domains registered to the same residential address, same emails, same contact names, repeated across multiple domain registrations. Remember when I said that who is information, is not necessarily accurate and correct? That is true. You may not actually get a real person's name or a real person's location, but the fake information they have added operates in exactly the same way when you're using that as a data point. So the king of England or, you know, Mickey Mouse care of Disneyland becomes a unique indicator, in your investigation. It may not assist you in arresting someone if that's your goal, but it will provide you with potentially linked infrastructure as you as you go along. And then you're looking at shared IP infrastructure. You're looking at domains with the same IP addresses. Remember when I said that, the more domains you have on IP, the harder it is to actually, link those domains to one particular entity because of the false positives and the the white noise that is included. You know, look for those low numbers. Look for those, the that information that's rotating through on a regular basis. If you see a GoDaddy or a CloudFlare IP address, maybe you want to not necessarily prioritize that one, because, you know, the way that they operate, they will have thousands of domains per IP address because that is their business model. There may be other indications to go through, as well. But patterns start to to emerge. And, you know, with most people using AI now, finding those patterns in data has become significantly easier, than it was even, you know, a couple of years ago when a lot of people were still doing these things manually. And we'll touch upon domain generation algorithms, etcetera, a bit later on. So key takeaway here is rerun your searches. Do not rely on everything being accurate, all the time. Rerun your searches. It may give you an indication of how this group or how these people are actually operating, as a criminal enterprise. So each data point, as I said, leads to leads to the next. You have your starting domain. You have your shared IP address. You have your related domains. And in this particular instance, there were some shared Klarna text. So now we're pivoting into, actual visual inspections of the websites themselves and potentially a physical location. So Klarna is a payment, platform or payment mechanism, for for those that are not aware. But each one of the domains, the websites that are being utilized had the same exact text, added to it. Now, again, the caveat here is you need to take some time to validate whether that is a unique indicator or whether that is, you know, the branding wording associated with the thing that you may be looking at. You know, using Red Bull as an example, Red Bull gives you wings is trademark branding information associated with that product. So that's not gonna be a unique indicator on a 100 websites potentially associated with Red Bull. So but if, you know, if if you misspell red and put in two e's, that suddenly becomes a unique indicator, because that's not how they were, intending on that word being being used. So in this particular, instance, there was multiple sites using identical payment description text, word for word including, and this is the key part, including errors across multiple, operating clusters. It was the, spelling mistake or the grammatical error, in this case, which was the key indicator. That was the unique piece to look for. There was a space after the word finished and before the period. Simple mistake, probably very difficult to to pick up, if you were doing a visual inspection, especially if you're harrowing, but it became a very clear differentiator between the actual official wording that, you know, the websites were supposed to be using and this wording, that was part of the investigation. And a lot of the websites started to give physical locations, not an unusual occurrence. Physical locations are often given on websites, and they often come back as false. Obviously, false. Again, I will go back to the examples of people giving the location of, you know, the castle in Disneyland or giving the location of the White House or or other well known easy to find, locations because, again, the verification process is just looking at whether a ZIP code or a postcode actually exists. It doesn't necessarily look to see if the White House is registering websites associated with fraud. But this is where, you know, your visual, pieces of information come in into play as well. So when DNS isn't enough, you look at the website, the website itself. So in this particular examples, you had Benny sorry. Bonnie Hair Company, shop now pay later with Klarna. And then you had Ashmari Premium Wigs, which was shop now pay later with Klarna. You'll notice that, you know, you have the ellipsis after the time. This was one of the reasons why rather than pulling the information direct from the Klarna website, they were starting to use a templated piece of information going going forwards. They were also linked, via the Google Analytics code. And remember I said that that is one of the key indications that often gets overlooked, in investigations. Now you can pull the Google Analytics code from the source code of a website, and there's different ways of doing that depending if you're a Mac or a Windows user. And there are some, platforms such as domain tools, that actually include, Google Analytics codes in their results summary. Also include Facebook codes, other payment operators. Baidu is also included, and there's the whole list of potentially unique indicators. Now even even though the websites are clearly not, identical and allegedly being operated by different people in different states or different countries, the mere fact that the Google Analytics code is the same across these websites is an indicator that at least the infrastructure is managed by a single entity, whether it be that a person or a group. Again, there is a caveat here that this is not necessarily, you know, an advertisement of a legal activity because if you have used WordPress or any other, sort of content hosting company, you're encouraged to add your own personal Google Analytics code in there for your various different websites across the board, or the hosting company will create one for you, and you'll find, you know, websites, lots of websites associated with WordPress and and so on, with a single code. So it's not an indicator of illicit activity. But if you know that you're looking at something that is illegal or illicit or potentially malicious, then having that code certainly indicates that they're being controlled by a single person. From an evidential standard, is that enough to go away and get a warrant or a subpoena? Not my call. That is something you would have to develop yourself. But it is another search parameter you can then go out and simply search for that analytics code, in whichever platforms you're using, and it should theoretically, even if you're just Google Dorking, it'll return all the other domains associated with that particular code. Really, really useful piece of information. Again, I highly recommend, adding that to your investigation repertoire or your investigation process, because it can make some links that previously you were struggling to to actually do. And we've already mentioned the spelling mistakes, bad translations, identical product description, shared payment provider boiler plates, template structure, image asset names, Google ID, all this information, even the shared Flavicon, Flavicon, starts linking domains to each other. Here is another, top tip. If you're using a platform such as Silent Push or Domain Tools, you have the ability in there to actually see the website tags or the website titles. For those who may not be aware, when you're, in Google or your search engine of choice and you hover your mouse cursor over the name of the list of the websites or the list of the returns if you're looking for a particular website, there's a description box that pops up saying, you know, this website is selling coffee mugs, is based in here. It's a really, really small description, normally a paragraph or a couple of sentences. That's known as the website title or the website tag. From a criminal enterprise, from a management perspective, having all of your domains associated with a single website tag or website entity just makes them so much easier to manage because no criminal or no bad guy wants to try and manage a thousand websites a day individually. It just becomes too much work, and, obviously, their goal is to work less, gain more money. So, it becomes a data point which you can search for. The more unique the website tag or title, the more likelihood is that you're gonna return results which are specific to your particular group. So if I'm searching for blue sky, I'm likely to get a lot of false positives in that list because those two words in in most languages go together to signify an actual thing. The sky is blue, so blue sky. But if you're looking for, two words put together, like purple and trumpet, those two words generally don't appear in in languages together, or not frequently. That becomes more of a unique indicator. So looking for things along those lines. And, again, if especially if they're using a title name for their websites, if you're looking at romance fraud sorry. Romance scams, recovery scams, etcetera, they all have fake company names, x y z recovery or x y z investment. They will use x y z investment as their title tag, for all of their ten, fifteen, a 100, a thousand websites that they're particularly, that they're using, and group them all together. Fantastic piece of information. Scrape that that data, and then you just go back to doing your searches, through, the various different other data points that you may be able to gather from that data, the different IP addresses, the different SOAs, the different who is information, and and and and so on. So, copy paste infrastructure is not, coincidence. Paying four interest of free payments, Clara, lets you split your purchase, amount into four equal payments paid every two weeks. This was copy and pasted across six different, branded websites. You can see those websites, on the right on the right hand side. Again, if you don't have access to a specific tool or specific platform, don't worry. Google Dorking, will potentially return at least most of the results associated with a specific text. You know, and a Google search in this instance, did return the exact string returns, across six separate brands. You and, again, this is more, thinking process. You're not necessarily gonna get the same wording with the same mistake across six different brands. One brand, yes. Two brands, potentially, it's an offshoot. Six different brands with no other outward connection, that's very, very unlikely unless, of course, someone is being lazy and they are an issue just copying and pasting, from a website they have seen. That happens in the counterfeiting world, obviously. But in this instance, it gave an indicator of, domain names to actually go away and look at. And then when you compare those domain names to the passive DNS data that was being generated, the domain name started to fall into the pattern, or started to fall into the dataset of the passive DNS information. So you're starting to to roll in visual inspection of information into your DNS data set, two combined, gave you or gives you, in this instance, confirmation that the that they were at least all linked from an infrastructure perspective, then you have to go away and, ascertain whether they are doing something illegal or criminal. So in this case, again, closing the loop of real evidence. The who is address was obviously fake and false. Using platforms like Google Street View, I'm sure most people are doing this by default, but it's worth highlighting again that if they're giving the address of a particular physical location, they're giving you a photograph of a building or the front of a building or doorway using something similar as Google Street View, can either confirm or dismiss that for as a predict of a potential, investigation avenue. We're also using company registries as well. Hong Kong company registry traces the parent company in this particular instance. So, again, it wasn't necessarily based upon in the country of the actual investigation. The registration of the air quote company was actually overseas. You have the, director records, incorporation dates, and shareholding. Again, this is all very valuable information, that can be combined together. So if your corporate if a corporation date, started yesterday, you can have a rough idea that you're not necessarily going to see any domain names associated with this particular fraud or this particular scheme registered much before a couple of weeks before the actual corporation registration date. The two would tend to be very close together if it's a new and evolving scheme. It's not an exact science, but, again, it helps you narrow down your search parameters to a point where you're you're expanding them rather than starting as wide as you possibly can incorporating a lot of false positives and dismissing those, if you're starting with a narrow search, which is kind of counterintuitive, you can expand that search day by day or hour by hour or however you want to do it until you, either exhaust all the possibilities or you actually hit the information that you're actually looking for. And it's also the final step in removing any false positives. In this particular instance, two of these locations claimed to be, hairdressing salons. When you looked at the Google image, they were in fact hairdressing salons. But if you zoomed in on the names, the names were different. The contact numbers were different. The date range from the Google image was within the parameters of the alleged offenses occurring. So without vis physically visiting the locations themselves, you have a reasonable confidence level that, you know, these locations were simply chosen because, they were operating the same business, but they're not necessarily operating the same business. So we're gonna move on to toll scams, which I know, I said, are very fresh in people's minds. People are getting still getting texts on a daily basis, to say that, you know, they have, outstanding, payments due, etcetera, often in locations, that they've never even been to. And in some, in some states, toll roads don't even exist, but they're still getting these notifications via text message. So this example, this case study is gonna be slightly different. We're gonna take this from start to finish, and show you, all the information, that can be gathered as we go along. We're gonna touch upon, DGAs, domain generation algorithms, so you can see how they fall into this particular, process, how the text messages are actually sent, and how they're and how they operate that service, which is actually a separate service, and then, you know, the phishing page, and finally, the pay the the payment, or the payout and the wallets. And this is, electronic wallets. This is not, blockchain wallets, and how that piece is operating. So, it's industrial at scale and deliberately patient. So it's just taking, and it is a global event, but we'll take The US because it's easier, for me to do the to do the math on those. On average, they target two to three states per day, and each state is targeted for around a day and a half. I say a day and a half because, on days two, the operators, and, again, we know who these people are, they will start to rotate the domain names from, let's say, New York state into, California, and then that will continue using that information for the next day, and then they'll rotate and they'll rotate, and then they will rotate. They're registering, between four and six hundred four and five hundred fifty, four and six hundred, per day. And this is at its peak at the weekends, because everyone needs to have a break at the weekends. They actually drop off. And, without giving too much away during Chinese New Year, for the last two years, total scam traffic actually dropped to zero, which may give you, an indication of where the scam is actually, defrating from. So as I said, at weekends, it drops off by at least 50, so you're less likely to receive a text message over the weekends. Every single US state has been impacted, and every single US state, has received a message at least once, even those states with no toll roads. But the bad guys, because they're monitoring the engagement of the text messages and the payment information coming in, they very quickly get to see which states are worth targeting and which states are worth ignoring. So if I pick, Hawaii, for example, Hawaii has no toll roads. So they very quickly understand that there's no point sending this this type of message to, Hawaiian based phone numbers because there is almost a zero take up on those. And it's also worth, stating at this part is that they are not geolocating the individuals that they're sending the messages to. It is simply a blanket operation based upon the, area code that is attached to your phone. So they will literally target 202 and send messages out to every single 202 phone number that currently exists. Regardless of what location you may be in, that, you know, you still have your original, DC phone number in this in that instance. So it's not a geotargeting. So, again, this is why you will often receive messages stating that you owe something in a state or province, that you haven't been in for a number of years. And the amounts that are being requested are deliberately low, and this is deliberate. It's a volume game, that is not due to ray is not trying to raise suspicion, that it's potentially false. If I sent out a text message saying that you owed, $600 for a toll, your immediately first thought is that's not accurate. That's not correct. I'm gonna ignore that text message. But if I send one for $6.99, which is the average price, then that becomes more realistic because even a short journey, between two points on most of the toll roads is gonna cost you at least a couple of bucks, maybe a couple a couple of more. And the infrastructure is built to absorb takedowns, not avoid them. They build in the methodology. They expect websites to be disrupted. They expect, people not to respond to text messages. This is why it's a volume game. This is why they're registering, you know, 600, per day. So the domain registration is an automated pipeline, and I'm gonna try and stay away from any, any any statements here about why certain things are still available to people. But, essentially, they're targeting registrars, with lower reputations, which still allow bulk registrations. And I think most people would agree that there is very little commercial need to suddenly spin up a thousand websites in a single day and have those websites go live within fifteen seconds of you registering those websites. There's very few use cases in in a legitimate scenario where that is actually needed. If you are running a legitimate business, yes, registering 10 websites in a day, absolutely. You can see the purposes of the of that, and then and those websites going live over a period of time, but we're talking bulk here. The websites themselves are generated or, from a base name plus incremental characters. This is where the domain generation algorithm comes in, but this is also where it becomes predictable and identifiable from a pattern recognition standpoint. You do not necessarily need to understand how the DGA operates in terms of, what the seed phrase is or, you know, how it's algorithmic algorithmically, put together if you can see the pattern itself. So some examples here, for example and these are domain these are actual domain names just broken down into, know, how the DGA was particularly operating with those, those. So you have gov, dash, and then there was four rotating or four different characters. The key identifier here, for example, is again, we go back to your DNS mapping, your DNS tools, whichever platforms you happen to be using. If you simply constructed a wildcard monitoring for gov dash wild card, then the actual then four random letters that are then used as the, second part of the domain name essentially become irrelevant because you are pulling back every single domain name, registered in that day or that period that has the initial four characters remaining the same. So that's a key key identifier there. Again, the next one was, comdash, plus 20, different letters after that. The 20 different letters essentially become irrelevant because you're monitoring just for com dashes. Suddenly, you realize that the DGA is not actually that complicated. You're picking out the, determining factors within that DGA. And then, the newer versions, are actually using a a more dictionary based process. So, theoretically, using dictionary based words could be more complicated to start identifying the patterns. But as you'll see, on the next on the next page, once you understand or identify what the pattern is or you have a theory based around that pattern, and then using the other indicators that you would have gathered, the IP addresses, name servers, mail servers, certificate addresses, certificate hashes, etcetera, you can actually start building out, again, domains associated with this particular campaign, and identify the different words that they are using as part of a dictionary, based approach and then simply create monitoring for those dictionary based based words. You're looking at low cost abuse prone TLDs. You're very unlikely to see a .com or .org or .net, being used in this particular scam because they're high reputation, they're high cost, and, generally, relationships with enforcement agencies is quite high. You're going to see, .live, .top, .win. Now if you look at the general cost of a domain name across those three, three TLDs, you're looking at between 2 to $4 per domain. But if I'm getting, $20 per website per campaign, spending $4 on a domain, it's a no brainer. It's it's it's easy to, justify that particular cost. So the c dictionary, as I mentioned, is actually a fingerprint in itself. You don't necessarily need to know how the algorithm works, how the DGA is actually working. You start to understand that they're using specific phrases associating with, vehicle based travel to seed their domain names. And once you understand that, you start to look for those words, and those phrases being baked into, domain names. Without some other indicators, you do get a a few more false positives. But, for the most part, once you start looking at a campaign, you're also recognizing patterns, associated with it. So this particular campaign had around 80 to a 100, seed phrase words. Most of them were actually road or transportation related, but they were also, hazard, based, seed phrases as well, generally associated with travel, such as, hurt, risk, tear, lost, rock, etcetera. But, again, it did not change the number. What you simply saw from a domain generation process was a a slow decline in the number of domains being registered using one DGA, let's say, COM hash, moving to a different pattern. But when you looked at the passive DNS data, you saw on that passive DNS data the transition, on a single IP address from a com slash domain name to road slash or road something. And that gave you the indicator that, potentially, they were swapping into a new formula or a new process. So a small number of intake pass carry the entire operation. And for those of you involved in disruption, in some way, shape, or form, this is something, key to look at without having full visibility into the data itself. And when I say full visibility, let's say 90% of the domain names and IP addresses mapped, and identified, you're not going to be able to significantly disrupt the operation, that you're looking at. Bit of a controversial take, I think, or maybe, But, you see this constantly, in the press where a law enforcement agency or a government agency around the globe says, we have disrupted this particular, scam operation because we have, removed five websites or 10 websites. When you then actually go and look at, the websites and build out the infrastructure, you realize that the actual infrastructure was a 100 websites or 200 websites or 500 websites. So that actually that actual statement of we have disrupted is is incorrect. In fact, those 10 websites are part of the acceptable losses for that particular criminal group. They expect to lose websites on a daily basis. So you've actually potentially disrupted nothing at all, which is why this kind of mapping is essential to, maximizing the disruption. Does that mean that the criminal activity will stop? Maybe not. But if your goal is disrupting something, it's at least gonna take them offline, for a week or so, couple of days, whilst they have to rebuild their internal infrastructure. And if you combine that with a payment takedown, it becomes very disrupted. In this particular instance, 90% of the traffic is fronted by a single content delivery network, a single CDN. So if that single content delivery network got on board with some disruption activity, 90% of the toll scam activity would literally disappear overnight. Top three, registrars carry the bulk of the registrations. There are multiple registrars being used in this particular campaign. You would see that in the data. But out of that list of, let's say, ten, three are the primary targets for the actors. Maybe that's due to a lack of due diligence or cheapness of the domain names. It could be a number of reasons. But, again, if those three registrars were willing to work within the disruption process, it would remove the vast majority of this particular campaign. And they were hosted in concentrations or jurisdictions outside of, The US and Europe with limited cooperation, process. And this is deliberate. In this particular case, most of the domains were hosted, or using hosting infrastructure around Hong Kong. So maybe that approach is not the way forward for a lot of people, but, that's something to to look at later on. So these some some more examples of the complexity layer that adds or aids to detection. Conscious of time now. In that, you can see, you know, they'd use the set phrasing each time combined with a state. And there's some examples on left hand side of set phrasing or set words, And this would also then give you an indicator of which states were being particularly targeted at which period of time and how often and so on. And they would reuse the same subdomains over and over again. A subdomain is simply a word or letters or numbers or combination of those followed by a period, followed by the domainname.com. The phrase in front followed by the period is is your subdomain. Passive DNS, a great way to locate subdomains. A Who is record or a domain lookup will not provide you with subdomain names. Passive DNS is a tool, is a platform. If you wildcard your search for, google.com and put the wildcard period google.com, it will return every single subdomain that has ever been associated with google.com or your your domain, of choice at that particular moment in time. Gives you an indication of where might be what might be being targeted at this particular moment in time. So there's dozens of throwaway based domains, as I mentioned. It's a DGA. It's rotated on, on a daily basis. But here's just, again, some more examples of, how this DGA, would actually, keep proliferating. So how the link then reaches the victim's phones? There are over and this is just estimates. There are over 400 SIM farms worldwide. At the last assessment or last count, there were a 196 Symfarms in The US. And in one single state, there were 17 alone just for that single state. Certain states seem to be more targeted for sim farms than others, mostly on the coast, so East And West Coasts. Central locations, not, not so much. The criminal enterprises in their own right, They're normally run by separate operators. They're normally run as a business, for criminal groups, bad actors to communicate with each other, but also to send out spam messages, text messages. Exact they're broadly legal. It's based upon the same infrastructure that you would get if you sign up to notifications from, you know, your favorite coffee shop or fast food place or etcetera. The same text messages you get there use the same infrastructure as the scam text messages. It's the same platforms, the same tool. Difference being you haven't approved for that message to arrive on your system. Telecommunications carriers can actually tie them back to specific locations. I'm not gonna go into this too much because we're pivoting off into, different styles of investigation. Okay. So, you're looking at essentially, the step by step process of what happens here. And this is actually, a process or documented process that has been run, and this was an exercise conducted to see where your fine for your toll was actually going, from a payments perspective. So you would have your your toll scam. It would collect your billing details because you have to add that in. That's the first part. You've now given the scammers your billing billing details, your name and address, and so on. That can be used for, future, fraudulent attempts, re re, reattempts on payment, etcetera etcetera. You then enter your card details. Obviously, most people are gonna enter credit cards and so on. The goal is not necessarily to harvest a long list of credit cards, because in 2026, most criminal enterprises are fully aware that credit cards can get canceled literally within seconds, and they they don't have them resell value that they once had on the criminal markets. But what they are actually doing is immediately cashing out, that $7 that you've just paid and depositing that $7 into digital wallets, Google, Apple, etcetera. And there are mules or people employed, via a percentage of the profits gained to essentially access those wallets almost immediately and start cashing out into real world, physical items, TVs. We've seen, people using them on Amazon, accounts to pay for goods via Amazon. We've seen, in this instance, this was a Google Wallet, makeup, cosmetics. Anything that can be resold in a different location and resold very quickly is a potential target. So what you're looking at here is within minutes to hours after you've entered your details. That $7 is being used to buy a TV. Then that TV is then gonna be resold via a different platform by the mule, and then that, cash is then minus the 15% cut. That cash is then deposited into another platform, where the bad guys take the money away. It's a very simplified version, but then that's essentially what what happens. And it all happens within under twenty four hours. I know we have two hours, so I'm gonna go through this, as quickly as as possible. The infrastructure is theme agnostic. They will use the same infrastructure for different scams. Again, this is where the messaging, becomes critical. So your visual inspection of the information, the data, the templates, the setup being used combines with the digital aspect of your investigation, which is the IP addresses, domain names, etcetera etcetera. So you have the toll authority scam, but on the same infrastructure. So this is the same, sort of domain name system, the same sort of domain names, the same DGA, the same IP addresses. You also have government grants, scams running, claim your housing subsidy at a GBG confirmed deadline 11:59, etcetera, etcetera. We see, mobile phone provider scams running on the same infrastructure that, you'll see a government scam running on. So they're reusing the same infrastructure. They just use a different template from the actual, platform that they have access to. And, because it's, kind of it's joined but not joined, again, it depends on where your your focus is. It's the same registrar pipeline. It's the same hosting infrastructure. It's the same subdomain trust pattern. It's the same cash out model. So those statistics that we I mentioned earlier around the 90% disruption, going through the same, three registrars, that applies to this aspect of the scheme as well, because it's the same funnel. So you get those people on board, and you could literally disrupt this almost, in theory, overnight. And that's the key piece, but you need to still develop the, data. From the data perspective, the key thing to understand is you don't necessarily need to change your process. Just change your collection methodology to incorporate maybe a a different name, a different wording, or a slightly different DGA. The actual infrastructure and the data you're collecting is exactly the same. So then we're gonna quickly, cut touch on the last case study, and then I'm gonna leave some time, at the end for, any questions, if there is any. I can't see from here, unfortunately. So now we're gonna look, more at event driven, brand replicas. You know, there are some major sporting events happening, this year. You had the FIFA World Cup. We just had the Winter Olympics. Obviously, last year, we had the, Olympics, Europe, you have Commonwealth Games, Cricket World Cup, etcetera, etcetera. So we're introducing, at this point now, the transport layer certificates, the TLS certificates, and name server concentrations. So, again, we're look we're just gonna focus on a different aspect of the DNS data, which may not necessarily, initially form part of your your data collection process, especially if you're focused purely on the domain name and the associated information there. TLS certificates, SSL certificates, etcetera, they start to become a very key, piece to identify, in this case, this particular event driven, crime, enterprise. So, looking for the wrong language is the most common detection failure. Assuming that people are gonna be, attacking, you know, in in my case, an English speaking language base is essentially first part in making some mistakes and and and, you know, potentially missing some some indicators. Every single language is potentially, a a a data pivot path. For example, there is groups operating romance scams, pig butchering, targeting, specific nations like Ukrainians or Russians. You have, Italians based scams, etcetera. It's very focused on the areas that you're, that are being targeted, but you're not necessarily gonna see that at the data level. The data level is just gonna give you some numbers and some domain names and, hash values. So dismissing things because it appears in a different language is not necessarily a a a good approach. Stick to what the data is telling you because right at the very beginning, I said the data is uncorrupted, is untouched. It is, it is the single source of truth. Looking at domains and deciding that they they're not it's not the right thing because it's a different language can be a bit of a mistake. So in this particular dataset, there was almost 9,000, domains. 50 over 50% of them were registered in the same year. That's a key indicator. Having, domains registered over a much wider period of time could indicate that you're looking at either a much longer, long burn, criminal enterprise, or they are potentially legitimate in terms of their nature or their their use cases. Finding concentrations of domains registered in very short windows before major events is can be a key indicator of potentially malicious intent. That said, obviously, there is bulk registrations of legitimate websites before before, large events as well. You have to be very cautious of the data itself. In this particular dataset, almost 90% of the domains that were identified, were in a non English language. So that was a key indicator there. And all of them all of the domains were registered for one year. You can register domains for three years, five years, etcetera, which is a good indicator of maybe legitimate use. Most of these domains are designed to throw away, so the minimum period you can register a domain for is is one year. So then you start looking at the, remember I said, looking at the, web page tokens, the web page tags, the web page titles. You start to see here, and you may get an idea of what this exercise was looking at. World Cup was for almost three it was used in almost 3,000 of the domains. Platform, 1,500. Betting, over a thousand. So you're starting to put together a picture of maybe this is a sporting event related betting, organization or betting, infrastructure. And much like we saw with the toll scams, a small set of the of choke points carry most of the network. If you are going to be targeting something for disruption or, for, a takedown process, the traditional approach is to go domain name by domain name, which is not necessarily the most efficient, and we'll see why in some of the slides, coming up very, very shortly. But, you know, 53% of of this particular, campaign use the same DNS operator. 55% sat with the top four registrars in the list. 36% or almost 37% concentrated in just two, ASNs. So, again, these are areas where you can focus for disruption. Any one of those, can potentially significantly disrupt the infrastructure up to up to 55% of the domains could go offline if, the top four registrars in that list were cooperative, and that would could literally happen overnight. I'm fully aware it's not that easy, but this is, you know, sometimes we like to live in a fantasy world and everyone is actually here to help everyone, but sometimes not not that easy. But even 37% using two ASNs, if you block those ASNs at your firewall level, if they were targeting you, then that immediately reduces 37% of the traffic that's potentially attacking you. Again, it could be the fact that, you can reach out to the ASN owners, and they might be compliant. So a single certificate. Remember I mentioned around, SSL certificates, TLS certificates, and, you know, they they each come with unique fingerprints, unique hash values, etcetera. A single certificate in this particular dataset, was used for 97 of, 97 of the domains. Of the 4,000 unique certificates that were identified, 51 are shared across five plus domains. So you start to see how they're using other, linked infrastructure or single managed infrastructure to make sure that they're not losing track of the domains that they're registering. Certificates, and SSL, hashes, etcetera, are not normally something which people look at when they are researching the data. It's a key data point, though, that often gets overlooked. Like I said, a shared IP can be a coincidence, but there is no coincidence in multiple domains using the same certificate hash. Obviously, there are free certificate, services out there, that can provide you with, certificates, at any given moment in time. But even the free services with more than one domain on a on a free, service certificate requires a single entity to be managing that certificate. So it goes back to the fact that you're identifying that these are owned or operated by a single entity, and then it's your job to operate or map where that single entity is actually operating from. Closing the gap between investigation and enforcement. So in this particular example, there was almost 1,800 domains, identified, across one operator network. This is, you know, one one particular group. Out of that particular, group of domains, around 30% have been publicly reported as some kind of enforcement action by either a government agency or law enforcement or something along those lines. 407 of those domains can be linked to a single email address, which is, which is quite not quite unique, but it's a very, very simple data point to pull out, from from the link analysis. But in this particular instance, as the next slide will show, that wasn't something that was looked at by, the agency in question here. And in fact, it was quite clear that that information wasn't something that was utilized, when they decided to disrupt, or take down some of the the websites. And then where how you would do this in priority order. And, again, this is my version of a priority order. You may choose to do this in a slightly different way, prefer to get data in a different different entity. But over the last twenty plus years that, I've been utilizing, you know, DNS as an indicating platform or indicating solution for me, this is generally the way that I've fallen into, using that particular data. We're using, you know, passive DNS providers, Farsight, DNS DB, Security Trails, VirusTotal, RiskIQ. I'm not gonna read them all out. You can read this for yourself. These vendors all provide, you know, passive DNS information. Who is lookup, domain tools, ICANN has its own lookup and and so on. You have, log searches. So this is open source log searching, showdown, census, if you have access to those platforms. Don't necessarily bring you back the who is information, the domain information, but it will provide you with certain other information regarding what kind of servers are being used, what kind of infrastructure is being used, if you start putting in IP addresses and so on. You have, web analysis. Great great place to then start pulling out your your Google Analytics indicators. Your visual inspections, you know, your Google Street views, archive, Wayback Machine is another great, tool that, hopefully, everyone's utilizing already. But if you wanna get historical screenshots and you don't have access to URL scan or another platform along those lines, Wayback, is free, and it it can provide you with, you know, vital information. And then finally, depending what kind of working style you have, you have your data organization. So using, essentially free platforms like Maltego. There is paid versions of Maltego to start putting, visualizations, and visualize your pattern analysis within, the datasets, analyst notebook, etcetera. All of these help you for, what you're particularly looking at. And the good news is that, we are at the end. So, I'm gonna pause here. There are some takeaways. Pass the DNS. Utilize it if you have access to it. If you don't have access to it, start researching how you can get access to it. It's quite an easy tool to justify, going to your c suite or your managers, to try and get that information. Some platforms have certain amount of free data available from a passive DNS perspective. Two layers always beats one. Always try and visually compare the data or the websites to your your your, data collection pieces, and don't just rely on one or the other providing you with everything that you need to know. There will be indicators on both. Remember, it's never just one website. Every single data point is a pivot. Do not dismiss a data point because the information is obviously false or misleading because that's the way it's designed to be. In the right context, false information becomes or can become a critical, data point. Certificate hashes and shared name servers, are a stronger indicator of, you know, operator indicator finger fingerprinting than an IP address. An IP address can be shared across many, many people, many organizations, many domain names, but your certificate hashes are unique to that specific to to that specific certificate. And then always, finally, verify any digital links you can with, with physical evidence. Even if the Google map or Apple map that you're looking at and the picture says it's over a year old, if that is within the parameters of what you're looking at from a a website or an organization's perspective, then even that year old image is still valuable data and valuable information. I can't tell you the number of times that, I've looked at an address, on Google Maps, and it's actually a vacant lot. So you can quite easily turn around and say that within the last six months, they haven't suddenly built a major, you know, tower block on that vacant lot because six months ago, it was a vacant lot with parked cars, etcetera, etcetera. So, again, it's reasonable, reasonable standards. So I'm gonna stop sharing now and hand it over to see if there is any questions. Oh, there's a lot of questions. So just looking at the the q and a, a lot of time with pig butchering websites, there is no lead on way back. URL URL scanning virus total, no details, no screenshots. They use masking services. How should investigator tackle this and where to pivot? So this essentially comes back to looking at the data, and the DNS data side of the things rather than relying on, the visual aspect. You still have to check the visual aspect, but URL scan, for example, relies on people uploading, you know, a particular URL to a particular, platform. And if you're looking at multiple domain names across multiple different, you know, campaigns, there isn't often, you know, too many matches. Wayback Machine has its own scanning process where it will scan a certain number of websites per day and and so on. You can request scans. So that that, information, is reliant on, you know, essentially a human almost a human level, input. Looking at the data, so the domain names, the registration, DGA certificates, etcetera etcetera, I can guarantee you, in most instances, you will find links. For those that, know me, for example, you know, they can I've been in situations where domain name has been given to me, and within a couple of minutes, we're up to 500 domains. That's purely just using DNS based infrastructure to map out those map out that infrastructure. So, don't necessarily rely on those. Is there a prerequisite needed for using the tools that you shared? No. Absolutely absolutely not. A lot of information, is available from multiple different sources. Obviously, the likes of silent push, domain tools, RiskIQ, etcetera, have consolidated a lot of information or a lot of processes into one platform. They do cost money, obviously, but it can make your life, a lot easier. But it doesn't cost you anything at all, to visually inspect a website, to visually inspect a source code, to pull that information off, to copy and paste, put it into an Excel document, and and so on. So there's no prerequisite at all. I'm going to pause there and just see, if there is any other questions or any other comments that anyone else has. Otherwise, I am complete, Joe. Okay. Questions are coming in. What dataset was this analysis performed on domain registration slide twenty twenty eight. I'm so bad. I can't remember what slide 28 was. That particular dataset, was a World Cup based dataset. So these those domains or domains there were allegedly associated, say, in some way description with, the upcoming World Cup. As it turns out, most of them were involved in Chinese language betting, which is going to be analysis that we're producing very shortly. But they were essentially linked from that particular, data. Is there a stuff to learn more? Is there a place to learn more about this? I'm interested in learning stuff from the last slide. A lot of the, tools and platforms will have, methodology associated with their platforms. Again, you don't necessarily need to have access to that data. There are plenty of YouTube, in tutorials out there as well. Obviously, you now have this one as well. And trial and error. Trial and error is a huge part of, you know, finding out what works for you and what work and what doesn't work for you and what data and information you have access access to. You're not going to break the Internet by accidentally, you know, looking at a number of IP addresses. I will always caution that if you don't know what you are necessarily looking at, clicking on every single URL that returns is obviously comes with its own inherent risks and dangers, not only with the content that's returned, but potentially with anything that's could be maliciously downloaded from those particular content. So, you know, take the necessary precautions, but, essentially, there is plenty of material out there that that can be that can be read. Okay. I'm gonna say thank you very much, and hand it back to back to Joe or Angela.