How to Archive Telegram Content to Document Russia's Invasion
In recent days, Telegram has been a vitally important tool for documenting the Russian invasion of Ukraine – ordinary Ukrainians regularly post videos and photos attesting to the scale of destruction caused by the war. This material has allowed us to geolocate multiple attacks on civilians and establish the Russian military’s use of cluster munitions.
But the online media environment in Russia and Ukraine at present is highly volatile. Archiving content from the ground ensures it can still be used by researchers if a user deletes a post, if a channel is removed, or if an entire platform becomes inaccessible.
For any type of internet content, links stop working over time, a phenomenon known as “link rot.”
Here is how to archive content so it can be preserved for years.
In recent days, Telegram has been a vitally important tool for documenting the Russian invasion of Ukraine – ordinary Ukrainians regularly post videos and photos attesting to the scale of destruction caused by the war. This material has allowed us to geolocate multiple attacks on civilians and establish the Russian military’s use of cluster munitions.
But the online media environment in Russia and Ukraine at present is highly volatile. Archiving content from the ground ensures it can still be used by researchers if a user deletes a post, if a channel is removed, or if an entire platform becomes inaccessible.
For any type of internet content, links stop working over time, a phenomenon known as “link rot.”
Here is how to archive content so it can be preserved for years.
Hackers compromised critical US infrastructure
Hackers from a group with the ironic name Ragnar Locker have compromised the networks of at least 52 organizations among critical US infrastructure. The government, energy, financial and IT sectors are under threat.
The FBI sent out urgent notices to organizations about possible attacks and requested any information that could lead to the group's trail. It has been operating since 2019, but frequently changing it's methods makes it difficult to catch them.
So for now, the raiders of the 21st century continue their raids.
Hackers from a group with the ironic name Ragnar Locker have compromised the networks of at least 52 organizations among critical US infrastructure. The government, energy, financial and IT sectors are under threat.
The FBI sent out urgent notices to organizations about possible attacks and requested any information that could lead to the group's trail. It has been operating since 2019, but frequently changing it's methods makes it difficult to catch them.
So for now, the raiders of the 21st century continue their raids.
Part of Fotostrana.ru dating service database got leaked
The number of lines is exactly 800 thousand (relevant for 10.2021), which indicates that this a piece of data is certainly part of a more complete drain. The database contains complete information on users:
⭕️ Name;
⭕️ Date of birth;
⭕️ Phone;
⭕️ IP address;
⭕️ VKontakte profile;
⭕️ Odnoklassniki profile;
⭕️ Facebook profile;
⭕️ and other technical information.
The number of lines is exactly 800 thousand (relevant for 10.2021), which indicates that this a piece of data is certainly part of a more complete drain. The database contains complete information on users:
⭕️ Name;
⭕️ Date of birth;
⭕️ Phone;
⭕️ IP address;
⭕️ VKontakte profile;
⭕️ Odnoklassniki profile;
⭕️ Facebook profile;
⭕️ and other technical information.
This media is not supported in your browser
VIEW IN TELEGRAM
Interesting tool for automating Instagram likes, follows, and comments
Go-instabot automates Instagram user following, liking pictures, commenting, and unfollowing people that don't follow you back on Instagram.
It uses the unofficial but excellent Go Instagram API, goinsta (v2).
They claim, that the script is coded so that your Instagram account will not get banned ; it waits between every call to simulate human behavior.
Go-instabot automates Instagram user following, liking pictures, commenting, and unfollowing people that don't follow you back on Instagram.
It uses the unofficial but excellent Go Instagram API, goinsta (v2).
They claim, that the script is coded so that your Instagram account will not get banned ; it waits between every call to simulate human behavior.
New list of countries in which Israeli infosec companies can export their products.
Following NSO's Pegasus incident, The Israeli Ministry of Defense greatly undercut the list of countries in which Israeli infosec companies can export their products.
The new list included only democratic countries, including countries that are members of the EU and Five Eyes. Now the list looks like this: Australia, Austria, Belgium, UK, Bulgaria, Germany, Greece, Denmark, Iceland, Spain, India, Ireland, Italy, Canada, Cyprus, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Portugal, Romania, Slovakia, Slovenia, USA, Finland, France, Croatia, Czech Republic, Sweden, Switzerland, Estonia, South Korea and Japan.
https://thehackernews.com/2021/11/israel-bans-sales-of-hacking-and.html
Following NSO's Pegasus incident, The Israeli Ministry of Defense greatly undercut the list of countries in which Israeli infosec companies can export their products.
The new list included only democratic countries, including countries that are members of the EU and Five Eyes. Now the list looks like this: Australia, Austria, Belgium, UK, Bulgaria, Germany, Greece, Denmark, Iceland, Spain, India, Ireland, Italy, Canada, Cyprus, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Portugal, Romania, Slovakia, Slovenia, USA, Finland, France, Croatia, Czech Republic, Sweden, Switzerland, Estonia, South Korea and Japan.
https://thehackernews.com/2021/11/israel-bans-sales-of-hacking-and.html
👍1
Attacks on Ukraine's network infrastructure increased tenfold
The number of attacks on Ukraine's network infrastructure has recently increased tenfold, as noted by observational researcher Brian Krebs.
Government networks are under attack by vipers, phishing attacks on mailboxes of civilians and military servants, banks are after a series of DDOS attacks, and providers are being hit in the same way.
All these are just symptoms of the inevitable digitalization of conflicts in the 21st century.
The number of attacks on Ukraine's network infrastructure has recently increased tenfold, as noted by observational researcher Brian Krebs.
Government networks are under attack by vipers, phishing attacks on mailboxes of civilians and military servants, banks are after a series of DDOS attacks, and providers are being hit in the same way.
All these are just symptoms of the inevitable digitalization of conflicts in the 21st century.
Researchers discovered a Trojan-infected apps, that have been installed by at least 9.3 million users
Researchers from Doctor Web studied AppGallery, a standard catalog of applications in Huawei devices, and found dozens of games that contain the Android.Cynos.7.origin Trojan. The infected games have been installed by at least 9.3 million users.
Everything is pretty standard: some harmless app about a cute cat with unexpected access requests to making phone calls and geolocation. The child, quickly approves all the permissions to please himself with the game. Meanwhile, a cute game about another cat is transmitting to a remote server:
⋅ phone number,
⋅ geolocation,
⋅ network code and country code,
⋅ device characteristics,
⋅ parameters from the metadata of applications in which the Trojan is embedded.
It's especially disturbing, since the main target audience of such games is children
Researchers from Doctor Web studied AppGallery, a standard catalog of applications in Huawei devices, and found dozens of games that contain the Android.Cynos.7.origin Trojan. The infected games have been installed by at least 9.3 million users.
Everything is pretty standard: some harmless app about a cute cat with unexpected access requests to making phone calls and geolocation. The child, quickly approves all the permissions to please himself with the game. Meanwhile, a cute game about another cat is transmitting to a remote server:
⋅ phone number,
⋅ geolocation,
⋅ network code and country code,
⋅ device characteristics,
⋅ parameters from the metadata of applications in which the Trojan is embedded.
It's especially disturbing, since the main target audience of such games is children
❤1
Top OSINT Tools for Facebook Investigation
Here are the main sources of data that we use when conducting OSINT research on the Facebook social network:
login (Restore Access)
lookup-id (Find ID)
@usersbox_bot (Search by VK)
@getfb_bot (Search by Phone)
whopostedwhat (Find Posts)
sowdust (Find Posts)
maigret (Find Nickname)
whatsmyname (Find Nickname)
search4faces (Find Photo)
findclone (Find Photo)
yandex (Find Photo)
phantombuster (Parser)
archive (Archive Page)
fuckfacebook (Find Phone)
eyeofgod (Find Phone)
canarytokens (Check IP)
iplogger (Check IP)
facebook.com/browse/fanned_pages/?id=USERID (Find Likes)
facebook.com/friendship/USERID/USERID (Users Connections)
Here are the main sources of data that we use when conducting OSINT research on the Facebook social network:
login (Restore Access)
lookup-id (Find ID)
@usersbox_bot (Search by VK)
@getfb_bot (Search by Phone)
whopostedwhat (Find Posts)
sowdust (Find Posts)
maigret (Find Nickname)
whatsmyname (Find Nickname)
search4faces (Find Photo)
findclone (Find Photo)
yandex (Find Photo)
phantombuster (Parser)
archive (Archive Page)
fuckfacebook (Find Phone)
eyeofgod (Find Phone)
canarytokens (Check IP)
iplogger (Check IP)
facebook.com/browse/fanned_pages/?id=USERID (Find Likes)
facebook.com/friendship/USERID/USERID (Users Connections)
Script for automatically starting Vkontakte conversations
VKMSSG is a python script aimed at creating endless conversations on VKontakte according to the parameters you specified. Can be used as wrapping messages. Can be used to make money on traffic arbitration.
https://github.com/TermuxGodd/vkmssg
Keep in mind, to work with the script, we need 2 accounts - the sender and the addressee. First you need to get the sender token.
VKMSSG is a python script aimed at creating endless conversations on VKontakte according to the parameters you specified. Can be used as wrapping messages. Can be used to make money on traffic arbitration.
https://github.com/TermuxGodd/vkmssg
Keep in mind, to work with the script, we need 2 accounts - the sender and the addressee. First you need to get the sender token.
❤1
Western countries have frozen about half of Russia's gold and foreign exchange reserves
Western countries have frozen about $300 billion, of Russia's gold and foreign exchange reserves, since the start of the so called "special operation" said Russian Finance Minister Anton Siluanov.
The US made it clear to Beijing that it will be overtaken by “consequences” if China tries to help Russia compensate for losses from Western sanctions - White House
The French Foreign Minister said that the “new package of sanctions” of the EU against Russia will come into force, probably on Sunday and will include:
▪️import of iron and steel from Russia
▪️export of luxury goods
▪️prohibition of any investment in the oil sector
▪️expansion of the sanctions list of businessmen.
Seems like Russia has enough funds to ensure the production of necessary goods and payments.
Western countries have frozen about $300 billion, of Russia's gold and foreign exchange reserves, since the start of the so called "special operation" said Russian Finance Minister Anton Siluanov.
The US made it clear to Beijing that it will be overtaken by “consequences” if China tries to help Russia compensate for losses from Western sanctions - White House
The French Foreign Minister said that the “new package of sanctions” of the EU against Russia will come into force, probably on Sunday and will include:
▪️import of iron and steel from Russia
▪️export of luxury goods
▪️prohibition of any investment in the oil sector
▪️expansion of the sanctions list of businessmen.
Seems like Russia has enough funds to ensure the production of necessary goods and payments.
New script for searching Instagram GEO location
The Instagram location search script that enables to find Instagram location ids near a specified polygon (latitude and longitude). The list can be saved as a JSON file, or GeoJSON, and also supports a map to visualize the location of returned points.
https://github.com/bellingcat/instagram-location-search
The Instagram location search script that enables to find Instagram location ids near a specified polygon (latitude and longitude). The list can be saved as a JSON file, or GeoJSON, and also supports a map to visualize the location of returned points.
https://github.com/bellingcat/instagram-location-search
How to monitor someone else WhatsApp activity
OSINT is a universal thing. Someone uses tools to investigate military operations, someone - to follow a husband or wife.
Introducing Watools a service to control someone else's whatsapp. It checks the online status, captures the fact of communication between two users (by the time they were online), gives information about the user's habits (for example, sleep duration) and much more. etc.
In general, Watools is a kind of inside-spy. The target entered the messenger - you receive a push notification. Communicating with the "suspect"? You get testimonials.
Of the minuses: to use the service, you have to pay.
BUT! There is a trial - 8 hours. During this time, you will be able to determine whether the game is worth the candle or not.
https://watools.io/wa-watcher
OSINT is a universal thing. Someone uses tools to investigate military operations, someone - to follow a husband or wife.
Introducing Watools a service to control someone else's whatsapp. It checks the online status, captures the fact of communication between two users (by the time they were online), gives information about the user's habits (for example, sleep duration) and much more. etc.
In general, Watools is a kind of inside-spy. The target entered the messenger - you receive a push notification. Communicating with the "suspect"? You get testimonials.
Of the minuses: to use the service, you have to pay.
BUT! There is a trial - 8 hours. During this time, you will be able to determine whether the game is worth the candle or not.
https://watools.io/wa-watcher
Top OSINT Tools for IP Address Investigation
Here are the top sources we use when conducting IP address OSINT research:
maxmind (GeoIP)
sypexgeo (GeoIP)
ipinfo (GeoIP)
domaintools (WHOIS)
virustotal (Virus Check)
dnsdumpster (DNS)
ptrarchive (DNS)
dnslytics (DNS)
viewdns (DNS)
intelx (Leaks)
leakix (Leaks)
cyberhubarchive (Skype Leaks)
webresolver (Skype Leaks)
talosintelligence (IP Quality)
ipqualityscore (IP Quality)
spyse (IoT)
fofa (IoT)
censys (IoT)
zoomeye (IoT)
shodan (IoT)
alienvault (Framework)
spiderfoot (Framework)
robtex (Framework)
threatcrowd (Visualization)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
iknowwhatyoudownload (Torrents)
Here are the top sources we use when conducting IP address OSINT research:
maxmind (GeoIP)
sypexgeo (GeoIP)
ipinfo (GeoIP)
domaintools (WHOIS)
virustotal (Virus Check)
dnsdumpster (DNS)
ptrarchive (DNS)
dnslytics (DNS)
viewdns (DNS)
intelx (Leaks)
leakix (Leaks)
cyberhubarchive (Skype Leaks)
webresolver (Skype Leaks)
talosintelligence (IP Quality)
ipqualityscore (IP Quality)
spyse (IoT)
fofa (IoT)
censys (IoT)
zoomeye (IoT)
shodan (IoT)
alienvault (Framework)
spiderfoot (Framework)
robtex (Framework)
threatcrowd (Visualization)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
iknowwhatyoudownload (Torrents)
🔥1
How to monitor economic sanctions globally
Sanctions Explorer is a project initiated by a collaboration between Archer, a former Berkeley-based nonprofit using tech to improve human rights and human security, and C4ADS, a nonprofit dedicated to providing data-driven, evidence-based research on global conflict and transnational security issues.
The current iteration of Sanctions Explorer was developed fully by C4ADS Data and Technology team, and is meant to be a comprehensive source of all current and historical sanctions data across all major sanctioning authorities.
https://sanctionsexplorer.org
Sanctions Explorer is a project initiated by a collaboration between Archer, a former Berkeley-based nonprofit using tech to improve human rights and human security, and C4ADS, a nonprofit dedicated to providing data-driven, evidence-based research on global conflict and transnational security issues.
The current iteration of Sanctions Explorer was developed fully by C4ADS Data and Technology team, and is meant to be a comprehensive source of all current and historical sanctions data across all major sanctioning authorities.
https://sanctionsexplorer.org
The $1,000,000 DeepFake Challenge
The outcomes of the recent Kaggle DeepFake Detection Challenge (DFDC) give you a better sense of how algorithms can manipulate videos and what to look for when you suspect a video may be altered.
On the Kaggle Competition website the description of the challenge says, "AWS, Facebook, Microsoft, the Partnership on AI’s Media Integrity Steering Committee, and academics have come together to build the Deepfake Detection Challenge (DFDC). The goal of the challenge is to spur researchers around the world to build innovative new technologies that can help detect deepfakes and manipulated media." The winners of the challenge were awarded $1,000,000.
This challenge contains 100,000 DeepFake videos and 19,154 real videos, which make up just over 470gb of video data. While the data for this project was based on data from Kaggle's Deepfake Detection Challenge (DFDC).
Here is a link to the Github repository for the winning model.
The outcomes of the recent Kaggle DeepFake Detection Challenge (DFDC) give you a better sense of how algorithms can manipulate videos and what to look for when you suspect a video may be altered.
On the Kaggle Competition website the description of the challenge says, "AWS, Facebook, Microsoft, the Partnership on AI’s Media Integrity Steering Committee, and academics have come together to build the Deepfake Detection Challenge (DFDC). The goal of the challenge is to spur researchers around the world to build innovative new technologies that can help detect deepfakes and manipulated media." The winners of the challenge were awarded $1,000,000.
This challenge contains 100,000 DeepFake videos and 19,154 real videos, which make up just over 470gb of video data. While the data for this project was based on data from Kaggle's Deepfake Detection Challenge (DFDC).
Here is a link to the Github repository for the winning model.
How to track military forces movement on land and sea
Tracking Military Aircraft
Tracking information (detailed route and a variety of technical details) about military aircraft flying over a specific territory (Europe, Middle East etc.).
Tracking Military Ships
An interactive map that shows the location and direction of warships in real time.
Tracking Military Aircraft
Tracking information (detailed route and a variety of technical details) about military aircraft flying over a specific territory (Europe, Middle East etc.).
Tracking Military Ships
An interactive map that shows the location and direction of warships in real time.
How to quickly analyze Javascript files
SourceWolf is an interesting tool for analyzing Javascript files. It finds all the variables, endpoints and social media links mentioned in the code in just a few seconds.
https://github.com/ksharinarayanan/SourceWolf
SourceWolf is an interesting tool for analyzing Javascript files. It finds all the variables, endpoints and social media links mentioned in the code in just a few seconds.
https://github.com/ksharinarayanan/SourceWolf
Ukraine Crisis Tracking Tools
Twitter account @Ernest4003, the founder of Sussex Global Analysis, created a Start. me page with links to several sources of information that track the current situation in Ukraine. From news and sanctions, to cams and links to other sources.
If you are following the crisis, this is a good collection to bookmark.
https://start.me/p/lLBdE6/ukraine-crisis-tracker
Twitter account @Ernest4003, the founder of Sussex Global Analysis, created a Start. me page with links to several sources of information that track the current situation in Ukraine. From news and sanctions, to cams and links to other sources.
If you are following the crisis, this is a good collection to bookmark.
https://start.me/p/lLBdE6/ukraine-crisis-tracker
How to use satellite imagery to visualize changes in landscapes
It is absolutely phenomenal knowing that we live in a time where anyone with an internet connection can easily gain access, for free, to satellite imagery gathered from satellites orbiting Earth. Every day millions of images are collected, capturing every nook and cranny of our planet.
With the right tools and skills all of this data, can help geolocate an image or video and, in some cases, even narrow it down to a time period (this referred to as Chronolocation).
https://gralhix.wordpress.com/2022/02/23/how-to-use-satellite-imagery-to-visualise-changes-in-landscapes/
It is absolutely phenomenal knowing that we live in a time where anyone with an internet connection can easily gain access, for free, to satellite imagery gathered from satellites orbiting Earth. Every day millions of images are collected, capturing every nook and cranny of our planet.
With the right tools and skills all of this data, can help geolocate an image or video and, in some cases, even narrow it down to a time period (this referred to as Chronolocation).
https://gralhix.wordpress.com/2022/02/23/how-to-use-satellite-imagery-to-visualise-changes-in-landscapes/
How to geolocate a Twitter video using free OSINT tools
A case study on how OSINT and geo intelligence enables to geolocate a Twitter video using free OSINT tools and how relying on information from the news can set you back.
https://gralhix.wordpress.com/2022/02/26/how-to-geolocate-a-twitter-video-using-free-osint-tools/
A case study on how OSINT and geo intelligence enables to geolocate a Twitter video using free OSINT tools and how relying on information from the news can set you back.
https://gralhix.wordpress.com/2022/02/26/how-to-geolocate-a-twitter-video-using-free-osint-tools/
Extracting information about Google documents
Xeuledoc enables yo to fetch information about any public Google document, including:
- Google Drive
- Google Docs
- Google Spreadsheets
- Google Slides
- Google Drawning
- Google My Maps
- Google Apps Script
https://github.com/Malfrats/xeuledoc
Xeuledoc enables yo to fetch information about any public Google document, including:
- Google Drive
- Google Docs
- Google Spreadsheets
- Google Slides
- Google Drawning
- Google My Maps
- Google Apps Script
https://github.com/Malfrats/xeuledoc