Uncovering GoPhish Deployments
ID: cbb3b067-1dd6-5b0f-a5ac-d3557ae2daa2
STIX ID: report--cbb3b067-1dd6-5b0f-a5ac-d3557ae2daa2
Feed Name: IntelInsights (Substack)
The report outlines quick OSINT techniques to uncover GoPhish administrative interfaces by pivoting on artifacts like gophish.css in urlscan results and shared HTML tags in Censys, then clustering infrastructure via DNS names, hosting providers, and SSH fingerprints; it highlights common phishing-themed domain patterns and provides a short list of recently observed IPs/domains that may host GoPhish dashboards, while cautioning that many entries could be benign or inactive.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.