PhishIntel: Open-Source Python and Go Tool Automates Web Reconnaissance for OSINT Analysts
PhishIntel is an open-source web-reconnaissance utility designed to build an initial intelligence baseline about a target domain or website. Written in Python with selected modules in Go, the tool requires no external dependencies and starts with a single command: python3 main.py.
After launch, users choose a language and then access the main crawler, which recursively visits a user-specified number of pages at a chosen depth while controlling concurrent requests. The crawler extracts Russian and American telephone numbers, email addresses, cryptocurrency wallet identifiers, and physical addresses that match dedicated HTML fields or explicit address patterns. It also records external domains, API endpoints, JavaScript files, and page-visit statistics.
Domain-level information is gathered in parallel and includes DNS records, IP addresses, reverse DNS, RDAP, WHOIS data, TLS certificate details, redirect chains, discovered subdomains, and local DNS/TLS history. A lightweight Go port scanner checks a small set of common TCP ports to determine service availability and basic technology identification.
Within seconds the primary output is saved as a structured JSON report. Analysts may also generate a concise HTML version that presents the same data in a more readable layout. The standard report contains email addresses, telephone numbers in multiple formats, addresses, contact-bearing page URLs, external domains, API endpoints, JavaScript files, crawl counters, DNS and TLS artifacts, and limited port-scan results.
Although an .env file is optional, users who wish to modify user-agent strings, add proxies, or adjust scanner behavior can populate it according to the provided .env.example template. The Go port-scanning module can be extended and recompiled; brief documentation is included in the scanner directory.
The author positions PhishIntel as a simple, extensible starting point for detectives, analysts, and OSINT specialists who need a rapid first-pass data collection capability before moving to deeper manual or automated investigation.
Related articles
Silent Call Answering on Android: Defeating Phone Spam by Removing Human Attention
A detailed proposal suggests abandoning traditional spam call blocking in favor of allowing all incoming calls to connect automatically while keeping them invisible to the user. The approach uses Android's Telecom Framework and InCallService to answer calls silently without ringing, notifications, or screen activation. This breaks the economic model of mass dialing systems by inflating answered call metrics with empty connections that contain no human. The concept separates the technical establishment of a call from delivering user attention, forcing spammers to detect real people after the connection is made. Implementation requires the app to hold the ROLE_DIALER role and selectively invoke Call.answer() based on custom rules instead of always showing the incoming call UI. The author argues this shifts the detection burden onto robocall platforms and reduces the value of every successful connection.
Telegram Scam Bot Exposed by Fixed Timer and Deleted Messages in Telethon Userbot Analysis
A detailed investigation into a romance scam attempt on Telegram revealed an AI-driven userbot masquerading as a woman named Maria from Yaroslavl. The bot maintained consistent 4-5 minute response delays regardless of message length or time of day, responded to deleted messages, and accumulated multiple inputs before replying in batches. It refused out-of-character requests using repetitive phrases like "I am not a..." and handed off media or confusing inputs to a human operator. The bot failed to react to a nonexistent city name and ignored voice messages containing silence, leading to delayed human intervention. The chat was later deleted from the scammer side after testing, and the account ignored messages from a second profile. The analysis includes a full reconstruction of the bot's logic using the Telethon library, highlighting prompt protections against jailbreaks and reliance on fixed delays.
CACTER Upgrades PhishSim Anti-Phishing Simulation System to Reduce Employee Click Rates
CACTER has released an updated version of its PhishSim anti-phishing training platform that allows organizations to run realistic simulated attacks in just four steps. The system replicates common phishing vectors including malicious links, infected attachments, and disguised QR codes while spoofing sender addresses and official domains. Organizations can draw from a continuously refreshed template library covering invoices, financial subsidies, system notifications, and industry-specific scenarios. After each campaign the platform produces detailed visual reports that rank departments, classify employee risk levels, and recommend concrete remediation steps. Long-term use of the platform has been shown to lower average click rates from 23.88 percent to 4.16 percent. The solution is designed for immediate deployment without requiring dedicated security staff.
Scammers Abuse Custom GPT on ChatGPT.com to Deploy Windows RAT via ClickFix Technique
Researchers at Huntress uncovered a phishing campaign that leveraged a custom GPT named Plus 5.6 hosted directly on the official ChatGPT.com domain. Victims searching for ChatGPT were directed to the malicious GPT through sponsored Google results, where the bot instructed them to visit a backup domain due to alleged service issues. The link led to a Google Sites page mimicking a Cloudflare security check that triggered the ClickFix social engineering tactic. Users were prompted to copy and execute a command in Windows, initiating a multi-stage infection with a remote access trojan capable of full system control, file access, screen viewing, and camera or microphone activation. Huntress confirmed at least 40 incidents tied to the campaign, though only two infections were directly traced to the malicious GPT. The first GPT was removed on September 25 after notification, but a replacement linked to the same operation appeared by September 27.