Detect, analyze, and investigate phishing campaigns end-to-end, email forensics, SSL/TLS analysis, domain intelligence, malicious document triage, and threat actor attribution with professional OSINT tools.
Lab tools you will use
Learn to detect, analyze, and investigate phishing campaigns, from email indicators and SSL certificate analysis to malicious document triage, attacker infrastructure tracking, and controlled simulation with GoPhish.
119 EUR
Advanced phishing investigation: polymorphic kit analysis, domain forensics, email authentication bypass (SPF/DKIM/DMARC), MFA attack simulation with Evilginx, and professional threat intelligence reporting.
159 EUR
Get the Beginner + Intermediate courses bundled together and unlock exclusive extras.
Each phase maps to a course module. Scroll to assemble your full progression — from beginner fundamentals to intermediate mastery.
Phase 1
BeginnerA reported email is the raw material. You learn to open it safely and extract what it will not tell you voluntarily.
Phase 2
BeginnerThe payload arrives as a document or a URL. Both can be examined without ever letting them execute or phoning home.
Phase 3
BeginnerEvery domain carries a public paper trail. This phase is about reading it without sending the attacker a single packet.
Phase 4
BeginnerAn investigation nobody can act on was wasted. You learn the reporting conventions the industry actually uses.
Phase 5
IntermediatePublic certificate logs are the highest-yield source in the discipline, because attackers publish to them without meaning to.
Phase 6
IntermediateA single address is a starting point. Pivoting turns it into a map — provided you know when a correlation means nothing.
Phase 7
IntermediatePhishing kits are deployed unmodified, so they carry constants. Find one and you find every other deployment.
Phase 8
IntermediateThe final step is following an actor across time and knowing where evidence stops and speculation starts.
The Phishing with OSINT path covers the full lifecycle of a phishing investigation: from the message landing in an inbox, through the headers that reveal where it really came from, to mapping the attacker's wider infrastructure and writing it up so somebody can act on it.
It is deliberately two disciplines in one. Phishing analysis without OSINT tells you a single email was malicious. OSINT without phishing analysis produces interesting data with nothing anchoring it. Together they let you answer the question that actually matters to an organisation: is this one message, or the visible edge of a campaign aimed at us?
The work is passive by design. You will learn where the line sits between querying public records and touching the attacker's infrastructure, why crossing it both compromises the investigation and can be a criminal offence, and how to get what you need without ever sending the target a packet.
The path uses more tools than fit here. These are the ones that define the work.
| Tool | Category | What for |
|---|---|---|
| urlscan.io | Safe browsing | Visiting a suspicious site on your behalf so your IP never reaches the attacker |
| Certificate Transparency | Infrastructure | Finding subdomains and sibling campaign domains through public certificate logs |
| Shodan / Censys | Infrastructure | Locating other servers running the same phishing kit by fingerprint |
| Maltego | Analysis | Building the pivot graph visually when an investigation grows past a few nodes |
| olevba / pdfid | Document triage | Extracting macros and embedded objects from malicious attachments |
| MXToolBox | Mail forensics | Checking SPF, DKIM and DMARC alignment on a suspect message |
| theHarvester | Reconnaissance | Understanding what an attacker can learn about your own organisation |
| CyberChef | Decoding | Unwrapping the layers of encoding phishing kits use to hide their payloads |
With indicators, sources and explicit confidence levels for each finding
Showing how one domain connects to the rest of the actor's estate
Formatted so a detection team can ingest it directly
Reading the hop chain and authentication results down to the true origin
Phishing remains the most common initial access vector, so investigating it well is directly useful in almost any defensive role — and it is one of the few specialisms you can practise without privileged access to anything.
Triages reported messages and decides what is campaign and what is noise
Tracks campaigns and infrastructure across time and victims
Determines scope once a phish has succeeded
Finds and takes down domains impersonating the organisation
Complete answers about this path, labs, certificates, and refunds
Querying public sources — registration records, certificate transparency logs, passive DNS — is legal, since that data is deliberately published. The path is explicit about where the line to active interaction sits, and why staying on the passive side protects both you and the investigation.
No. The path is built around what free tiers and public sources provide, which is considerably more than most people expect. Commercial platforms are discussed so you know what they add, but no lab depends on one.
Only incidentally. Tools such as GoPhish and Evilginx are covered so you understand what the attacker's side looks like and can recognise its traces — the path is investigative, not offensive.
Most of it. Infrastructure pivoting, certificate transparency and passive DNS are the same techniques used to track malware C2 and scam infrastructure. Phishing is the vehicle for teaching a general method.
No. A little scripting helps automate repetitive lookups and the path shows where, but every lab can be completed with command-line tools and web interfaces.
A repeatable investigative method and completed case write-ups from real infrastructure — which, for interviews, demonstrates rather more than a certificate does on its own.
