Finding Fraudsters Who Hide Behind Cloudflare
102Fraudsters and other threat actors use services like Cloudflare to hide their web infrastructure and make it hard for OSINT investigators to identify the IP addresses and services that they use.
This talk walks through several different OSINT techniques for identifying IP addresses and hosting arrangements hidden behind Cloudflare and how to verify these results.
The content of the presentation ranges from intermediate to advanced in terms of difficulty. Learn about:
DNS records
Subdomains
SSL certificates
Shodan/Censys
Some command line tools
The talk uses multiple real-life examples of how these techniques can be used to unmask fraudsters.
About the Speaker
Steven Harris is an open source intelligence (OSINT) specialist at QOMPLX, a data analytics and cyber security company, where he uses his expertise to identify security and business risks that his clients face and then helps them reduce their risk exposure. With a background as a detective, as crimes such as ransomware became more prominent Steven specialized in cybercrime. In his career, he received several commendations for catching groups of cybercriminals and improving the way that law enforcement respond to security vulnerability disclosures. He believes that open source investigation skills combine well with cyber security and considers it a great privilege to work in this field.
View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#OSINTSummit #OSINT