Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#phishing
Newest first
Lookalike Domains: Punycode, Homoglyphs, Typosquats and Combosquats
A Cyrillic "а" and a Latin "a" are different domains that look identical. How IDN homoglyph attacks, punycode, typosquatting and combosquatting work, how browsers decide what to show, and how to build brand monitoring that catches lookalikes without drowning in noise.
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Attackers stopped trying to beat MFA and started routing around it: illicit consent grants, device code phishing, reverse-proxy kits and push fatigue. How each technique works and how to detect and respond in Entra ID and Microsoft 365.
Certificate Transparency for Phishing Hunters: Catch the Domain Before the Email
Almost every phishing site wants a padlock, and every publicly trusted certificate is written to a public log. How to read an X.509 certificate, how Certificate Transparency works, and how to turn CT logs into an early warning feed for lookalike domains.
Business Email Compromise: The Billion-Dollar Attack Nobody Detects
BEC needs no malware, no exploit, and no payload. Just a convincing email and a wire transfer. Here is how it works, why tools miss it, and what stops it.
Phishing Email Analysis: Headers, EML Files, and Hidden Payloads
A hands-on dissection of a suspicious email: reading the Received chain hop by hop, interpreting SPF, DKIM and DMARC verdicts, and safely extracting URLs and attachments.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note