{"time":1703658147981,"blocks":[{"id":"BUpdt9sr0G","data":{"text":"In this article, we’ll explore two free but extremely useful and complete online tools for investigating any website for signs of phishing."},"type":"paragraph"},{"id":"kc1AYxfKBt","data":{"text":"Additionally, we’ll introduce two online security browser extensions."},"type":"paragraph"},{"id":"foesjSKgpp","data":{"text":"These extensions are valuable tools that even the most experienced web users should consider adopting."},"type":"paragraph"},{"id":"EGa_9Hc4MV","data":{"text":"They safeguard against that critical 0.1% that sometimes slips under the radar, identifying potential threats before any harm can occur."},"type":"paragraph"},{"id":"ROIpM8AGVF","data":{"embed":"https://www.youtube.com/embed/PPhnnDiQnw0","width":580,"height":320,"source":"https://youtu.be/PPhnnDiQnw0","caption":"","service":"youtube"},"type":"embed"},{"id":"0q6Gbszs01","data":{"text":"First Tool: The Wayback Machine","level":1},"type":"header"},{"id":"1la5s7e1k0","data":{"text":"The first free tool in the Wayback Machine.The link to the Wayback Machine is ‘https://archive.org/web/’"},"type":"paragraph"},{"id":"oYFWXh73E2","data":{"text":"Very important: While the Wayback Machine is not a common target for hackers and scammers, we encourage you ALWAYS to verify any link. After all, how do you know a malicious person has not hacked our ACCESS account and inserted a malicious link to this article?"},"type":"paragraph"},{"id":"3K8s9Aj0mD","data":{"text":"The Wayback Machine is a tool operated by the Internet Archive that allows users to view archived versions of web pages over time, providing access to historical snapshots of websites."},"type":"paragraph"},{"id":"xcQAWPW7i_","data":{"text":"It serves as a valuable resource for investigating the evolution of web content and can be used to verify the legitimacy of a website by examining its historical state."},"type":"paragraph"},{"id":"yqEXb9-y7q","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/d3eaedfc-14d4-49f3-a737-aa35ff179ec4/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"2vyW5MhNLl","data":{"text":"To demonstrate the use of the Wayback Machine, we’ll employ Google to search for the authentic Metamask site."},"type":"paragraph"},{"id":"dhIrBmdylw","data":{"text":"Given that Metamask is a frequent target for malicious activities, including phishing attempts, extra care is essential."},"type":"paragraph"},{"id":"74-ifgC_n2","data":{"text":"Over the years, numerous cases of deceptive Metamask results in search listings have led to crypto asset theft from unsuspecting individuals."},"type":"paragraph"},{"id":"CI6f9etF5H","data":{"text":"To ensure the authenticity of the first Metamask search result, we’ll right-click, select ‘Copy Link Address,’ and delve into further investigation."},"type":"paragraph"},{"id":"lj-SzTk22c","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/d21d8d4d-a7f6-407a-be2c-89e1a1d74c67/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"EcGa0glgT0","data":{"text":"Then, using the Wayback Machine website, we can paste the link we just copied from the search result and press ‘Browse History’."},"type":"paragraph"},{"id":"YNjLCbq_Du","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/369592e2-7d80-47f9-94f1-971c319a0d80/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"G51Bctr8KZ","data":{"text":"The Wayback Machine will display useful historical information about the website we want to investigate."},"type":"paragraph"},{"id":"lrj1P3GmBM","data":{"text":"For example, we can observe that the Wayback Machine took the first metamask.io snapshot in 2016."},"type":"paragraph"},{"id":"J44jGYSjic","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/ac175b8c-962d-4b46-a814-d524aed60b6e/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"bFQLxvkoRe","data":{"text":"This may indicate that metamask.io is legitimate because a quick search informs us that Metamask was released in 2016."},"type":"paragraph"},{"id":"Jqxl6GRPGV","data":{"file":{"url":"https://miro.medium.com/v2/resize:fit:630/1*wSMJDRZDknJh-ZCh8SnmHA.jpeg"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"3fCaHPNGxe","data":{"text":"But we will investigate further because the Wayback Machine has stored many snapshots of metamask.io over many years."},"type":"paragraph"},{"id":"_hqV2JF4nM","data":{"text":"And those snapshots can be used to verify that metamask.io has remained consistent over the years: An inconsistent website can indicate that a website has been for sale and maybe used (or is still being used) for nefarious activities."},"type":"paragraph"},{"id":"r_lgUbDtk-","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/ddece40c-fa33-4407-835d-1d0bd61fdf56/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"uWSg0HYtPC","data":{"text":"Next, we choose a year, 2018, and click over a date to access the snapshot."},"type":"paragraph"},{"id":"6-4wBTlKyU","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/7641d773-127e-41ca-938b-2364e9658ab7/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"6tdKaOBuwX","data":{"text":"The Wayback Machine will display that snapshot's content, which, for our date selection, shows how metamask.io looked on July 2, 2018."},"type":"paragraph"},{"id":"WunbaQW-GX","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/663722ff-69c2-4420-a12f-d0359d70f60d/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"S0n_UnkUUX","data":{"text":"At this point, we must use your knowledge and experience to assess the content of the snapshot and decide if the content matches what we expect from the legitimate metamask.io or if it belongs to a phishing website."},"type":"paragraph"},{"id":"PMm-8ik324","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/0f872b8a-e531-4644-8d42-35bcc9ebbdd4/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"fYYe3F_BS7","data":{"text":"Let’s look at a practical example of a phishing website and use the Wayback Machine to investigate the domain to provide some contrast or a reference."},"type":"paragraph"},{"id":"sWkferhUSj","data":{"text":"If you own crypto assets, it is likely that, at some point or another, your data has been leaked to the dark web through a data breach , and you are receiving emails like the one displayed below."},"type":"paragraph"},{"id":"yERAnEE9kG","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/f0e6a7bc-c3dd-40cd-b191-22abdb1ec24b/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"Tj8MXKeYvb","data":{"text":"The scammers are using some basic dark psychology, an amygdala hijack, to encourage us, the victims, to take quick action."},"type":"paragraph"},{"id":"BDLC71AlXa","data":{"text":"While ‘Metamask’ is mentioned at the top of the email, the sender's email address, ‘@iinet.net.au,’ has no relation to Metamask. "},"type":"paragraph"},{"id":"6wm9Y88fk0","data":{"text":"And that should already be a clear indication of a phishing email."},"type":"paragraph"},{"id":"_TX-XcUxbj","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/43853923-99ee-4be7-ba9b-744c5f2ae6da/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"25UPFtKkC_","data":{"text":"But, for education purposes, we have used one of our disposable laptops to click over the phishing link ‘Recover my wallet’ and check where it leads."},"type":"paragraph"},{"id":"nMuKenTR-k","data":{"text":"Note that you should neither open suspicious emails nor click over suspicious links because the following scenarios will most likely happen:"},"type":"paragraph"},{"id":"_zEGwEdDNF","data":{"items":["One: The phishing email will probably contain invisible tracking pixels informing the malicious person who sent it that your email address is active and that you are a suitable candidate for further phishing emails. This is because if you have exposed yourself, the information will be sold on the dark web and bombarded with many more phishing emails.","Two: While most phishing links are ‘relatively’ harmless, some will expose you to advanced hacks that hijack your session without notice. For example, some malicious links can bypass Two-Factor Authentication and take over your accounts."],"style":"unordered"},"type":"list"},{"id":"hfYIj6tfLU","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/01b5f837-60be-47dc-9d50-8cce05ad953a/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"qs65GUm7cw","data":{"text":"The malicious ‘Recover my Wallet’ link does lead us to a malicious website that encourages us to enter our Metamask wallet seed phrase."},"type":"paragraph"},{"id":"FxRZ_Xu-nd","data":{"text":"The malicious website domain ‘ammunitionstore.com’ has nothing to do with Metamask. And that is another clear red flag indicating this is a phishing website."},"type":"paragraph"},{"id":"43IerYA_le","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/991ebc7c-1479-4216-b194-db1dd64b2462/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"tDgfTMe0o3","data":{"text":"But a phishing website is not always so obvious, so in case of doubt, we can use the Wayback machine to investigate it."},"type":"paragraph"},{"id":"JUKGs2QSjd","data":{"text":"The results show that the first ‘ammunitiongunstore.com’ snapshot was taken in March 2023."},"type":"paragraph"},{"id":"JAxtj-9Yl1","data":{"text":"That already indicates that this is a website of recent creation and does not match the information we have already researched about when the Metamask project was started."},"type":"paragraph"},{"id":"BQwr_o6Yq7","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/69296fa8-f4fe-43b0-b10a-21eb57385ffe/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"rhihuaGGY9","data":{"text":"Also, ‘ammunitiongunstore.com’ has just a few snapshots. Which is another potential indicator of a phishing website."},"type":"paragraph"},{"id":"gJauw6vLuS","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/d0d37f09-a1e5-4f01-8259-769331ec15a9/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"841MPbE1Rp","data":{"text":"Clicking over one of those snapshots shows a very poor and basic website."},"type":"paragraph"},{"id":"wlwmByImNh","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/8b359a87-87de-4d11-8a08-29c1884d848b/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"82r9MigOJ6","data":{"text":"While not all phishing websites are as obvious as ‘ammunitiongunstore.com, ' with some knowledge and awareness, anyone should be able to identify 99% of phishing websites using the Wayback machine as a tool."},"type":"paragraph"},{"id":"LFevf9aizo","data":{"text":"Second Tool: Who.is","level":1},"type":"header"},{"id":"m80xPAZNCp","data":{"text":"The second free tool is Who.isThe link to the who.is website is ’https://who.is/’"},"type":"paragraph"},{"id":"MT8K_597Wl","data":{"text":"Very important: While Who. is not a common target for hackers and scammers, we encourage you ALWAYS to verify any link. After all, how do you know a malicious person has not hacked our ACCESS account and inserted a malicious link to this article?"},"type":"paragraph"},{"id":"8VWu5dbiDq","data":{"text":"Whois is a database of information related to domain registration."},"type":"paragraph"},{"id":"Sj8QudQwkM","data":{"text":"While Whois may not directly detect phishing websites, it can provide us with valuable information about the domain’s registration details."},"type":"paragraph"},{"id":"Nq4CRn6NB_","data":{"text":"Analyzing this information can help us assess the legitimacy of a website."},"type":"paragraph"},{"id":"YMt_97tnd_","data":{"text":"Here’s how to use Whois to gather information and potentially identify phishing websites."},"type":"paragraph"},{"id":"in_pW8t4n6","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/a6e4def7-61d4-472c-954d-37a86552b1b7/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"SfWwwj1KpX","data":{"text":"Once on the legitimate ‘who.is’ website, we can search for the website we want to investigate."},"type":"paragraph"},{"id":"y3ELss53bX","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/d39b6ebb-8287-4695-be75-c1764c0b7fae/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"EXzt6vrMax","data":{"text":"For this example, we again check the link we copied from our Google search."},"type":"paragraph"},{"id":"Gxy5cbBpYj","data":{"text":"We copy it to the ‘who.is’ search bar, and we will review that the results match what we expect from the legitimate Metamask domain."},"type":"paragraph"},{"id":"PrbHd6AUgy","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/f38597af-3067-4adc-89b1-7843e2e27aa4/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"tgwLP9X6yy","data":{"text":"The results show that the metamask.io domain was registered in July 2015, was updated in October 2023, and expires in July 2024."},"type":"paragraph"},{"id":"2Tr-H5541j","data":{"text":"Additionally, at ‘who.is’, we can access other information like the name of the organization that has registered the domain and the contact information."},"type":"paragraph"},{"id":"g4UTs2OzyI","data":{"text":"The data does match what we could expect from the legitimate Metamask website, and there are no inconsistencies."},"type":"paragraph"},{"id":"KfIAr2Syn5","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/0fd64754-51ee-47ec-9a46-dd1a89652b6d/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"wroBwM53ua","data":{"text":"Instead, we find barely any information if we investigate ’ammunitiongunstore.com’. This further reassures us that this is just a fake Metamask phishing website."},"type":"paragraph"},{"id":"LIGoDTROpZ","data":{"file":{"url":"https://cdn.bulbapp.io/frontend/images/0ad8fd42-929f-46e2-a362-b60c85061a6e/1"},"caption":"","stretched":false,"withBorder":false,"withBackground":false},"type":"image"},{"id":"fqJPX6zSBW","data":{"text":"Third Tool: Online Security Extensions","level":1},"type":"header"},{"id":"Jb8YPRw8u5","data":{"text":"Using the Wayback Machine or Whois should allow you to identify most if not all, phishing websites."},"type":"paragraph"},{"id":"gtwXxEVDlH","data":{"text":"But we are all humans and prone to human errors. We may have a bad day, be in a hurry, or be distracted, and we may click on a malicious link that leads us to a phishing website."},"type":"paragraph"},{"id":"gL-dXbLS0P","data":{"text":"It may happen to anyone."},"type":"paragraph"},{"id":"ahIRiIkuMj","data":{"text":"Luckily, there are free tools that we can use to compensate for lapses and keep us safe."},"type":"paragraph"}],"version":"2.26.5"}