ZeroTrace


> 👨‍💻 Written with curiosity by `NemeSys@`

### What Are Buyer's Clubs? (And Why Should You Care?)

Picture this: You join an exclusive club where you're told exactly what to buy on any major e-commerce platform (eBay, Amazon, Etsy, Walmart, etc.), ship it to a specific address (operated by the Buyer’s Club, of course), and get paid back - all while earning sweet credit card rewards. Five nights in Bali paid for by rewards at no cost to you? Sounds too good to be true, right? Well, it's real, and it's called a Buyer's Club!

### 🧾 The Basic Breakdown:

- Members buy specific items (usually electronics)  
- Ship to designated addresses  
- Get reimbursed (sometimes with a small profit or stipend)  
- Rack up credit card points/miles  
- Some clubs even help with tax exemptions! 🤑

### The Dark Side of the Deal

But here's where things get spicy. Many e-commerce investigations teams, myself included,  have uncovered some challenges with Buyer’s Clubs and exposed the criminal underbelly of some of these groups. While the basic concept of a Buyer’s Club isn't illegal, some bad actors use these clubs as a front for less-than-honest activities. Think "lost" packages that weren't really lost, if you catch my drift.

### When Buyer's Clubs Go Bad

While many buyer's clubs operate legitimately, investigators have identified these operations as potential havens for various criminal enterprises. Let's dive into the concerning trends (I’ll provide my exact investigation methodology in a little bit):

### Money Laundering Highway 🚩

- Criminal groups can easily wash illicit funds through high-volume purchases
- Rapid turnover of goods helps legitimize suspicious money flows
- Tax documentation can be manipulated to create paper trails

### The Double-Dip Scheme 💸

- Members claim items weren't received while selling them through clubs
- Exploitation of liberal return policies
- Coordinated fraud rings disguised as legitimate buyers

### Identity Theft & Account Takeover 🕵️

- Stolen credentials used to make purchases
- Compromised business accounts exploited for tax exemptions
- Stolen goods trafficked through seemingly legitimate channels

### The Perfect Cover 🎭

- Complex network of addresses provides anonymity
- Business registrations create legitimate facades
- High volume of transactions masks suspicious patterns
- Multiple layers of shipping make tracking difficult

### Why It's Hard to Stop

The genius of criminal exploitation of buyer's clubs lies in their ability to hide in plain sight:

- Legitimate members provide cover for bad actors, making it difficult to sort out who is a bad actor and who isn’t
- Complex shipping networks obscure final destinations, wherein we might never be able to identify where the products ultimately go after being delivered to the Buyer’s Club
- Business documentation appears authentic
- High transaction volumes make pattern detection challenging

## Is it Detectable?

For e-commerce security professionals and retail loss prevention teams, several key indicators can help identify organized buyer's club activities:

**Order Pattern Analysis**

- Multiple orders from different accounts shipping to the same address
- High-volume purchases of the same SKU within short timeframes
- Unusual geographical patterns (orders from multiple states to a single location)
- Frequent bulk purchases of high-demand items

**Product Indicators**

- Focus on high-margin electronics and gaming consoles
- Consistent purchasing of newly released products
- Pattern of buying items with strong resale value
- Bulk purchases of limited-edition items
- Multiple orders of maximum quantity limits

**Advanced Detection Methods**

- Machine learning algorithms to identify unusual buying patterns
- Cross-reference shipping addresses with known reseller locations based on open source findings
- Monitoring of bulk shipping activity to commercial addresses

The best practice for e-commerce platforms is to implement a layered approach combining multiple detection methods while ensuring legitimate bulk buyers aren't impacted.

## Case Study/ Investigative Plan 📝

As a fraud investigator, I have investigated many complex schemes involving buyer's clubs that challenged our traditional detection methods. This case study shares my methodology and provides practical tools for identifying similar patterns in your own investigations.

**The Initial Trigger**

The investigation began with what seemed like a routine alert: a cluster of "Did Not Receive" (DNR) refund claims all pointing to a single PO box in New Hampshire. This simple data point would unravel a sophisticated fraud operation masked behind legitimate buyer's club activities.

**Following the Data Trail**

Initial analysis of orders shipped to the suspicious PO box revealed a clear pattern. The purchases concentrated on high-value electronics - Apple MacBooks, iPads, Samsung phones, and Amazon tablets, just to name a few.. More tellingly, the accounts were predominantly business accounts, which allowed them to bypass quantity limits on high-demand products (remember the PS5 shortage?)  and claim tax exemptions in certain states.

The breakthrough came when I noticed a peculiar naming convention in the shipping addresses: "BFRMxxxx", where 'xxxx' represented varying numbers. This led to my first investigative query:

```SQL
SELECT * 

FROM shipping_table

WHERE shipping_name REGEXP 'BFMR[0-9]+'
```
This expanded search revealed additional addresses that followed the same pattern explained above. At this point, I took to open source research to determine what this pattern might be - first creating a general Google search based on the acronym “BFMR” and the shipping address “51 S BROADWAY UNIT 2220, Salem NH.” This allowed me to find the website “bfmr.com.” 

**Findings**

 When I first started examining the data, the numbers seemed unremarkable. The overall refund rate for the Buyer's Club location was about 13% - a figure that wouldn't typically raise red flags. Traditional address-based risk signals weren't triggering our usual thresholds for fraudulent behavior. Yet something felt off.

After diving deeper into account-level analysis of thousands of orders shipping to Buy For Me Retail, a different picture emerged. Approximately 6% of accounts displayed clear signs of fraudulent activity. These weren't just one-off instances - we found a pattern of sophisticated fraud hiding beneath the surface of legitimate business operations.

The fraudulent accounts followed a distinct pattern. They weren't just using one Buyer's Club - they were spreading their activity across multiple clubs while al taking advantage of refund policies on personal shipments. Here's what we found when we looked closer:

**Order Patterns That Raised Red Flags**

The most suspicious accounts showed aggressive ordering behavior. We're talking about accounts placing more than three orders per hour, or new accounts spending over $1,000 in their first 24 hours. Perhaps most telling was the pattern of ordering more than five electronics items within a single day - a clear Buyer’s Club signature.

**Payment Behaviors That Didn't Add Up**

The payment patterns were equally suspicious. These accounts would cycle through multiple payment methods - often more than three different cards within 24 hours. We saw instances of split payments across multiple cards and a high volume of failed payment attempts before successful transactions.

**Shipping: The Shell Game**

The shipping patterns revealed another layer of sophistication. These accounts would frequently use more than three different shipping addresses within a week, often mixing residential addresses with wholesale, freight forwarder, or commercial locations. The mismatch between shipping and billing addresses became a crucial indicator.

**The Refund Red Flags**

Perhaps the most telling patterns emerged in the refund behavior:

- Multiple refund requests within a month
- Refund values exceeding 30% of purchase history
- Suspicious timing (either immediate or significantly delayed refund requests)
- Partial returns from multi-item orders
- Multiple "Did Not Receive" claims despite clear delivery confirmation

**Why This Matters**

This investigation highlighted a crucial lesson in fraud detection: surface-level metrics can be deceiving. While the overall refund rate appeared normal, the account-level analysis revealed a sophisticated fraud operation taking advantage of legitimate business infrastructure.

These findings have changed how we approach fraud detection in Buyer's Club scenarios. Rather than relying solely on address-based signals or overall refund rates, we've developed a multi-layered detection approach that considers:

Account-level behavior patterns

Cross-club shipping activity

Sophisticated payment analysis

Detailed refund pattern monitoring

The key is looking beyond individual transactions to understand the broader pattern of behavior across multiple accounts and platforms.

## Building the Detection Framework

Here's how we structured our analysis:

**Order Velocity Analysis**
```SQL
 SELECT account_id

FROM orders

WHERE orders_per_hour > 3

  OR daily_total > 1000

  OR electronics_count > 5
```

This query identified accounts exceeding normal purchasing patterns, particularly focusing on high-value electronics orders.

**Payment Pattern Detection**
```SQL
 SELECT account_id

FROM payments

WHERE unique_cards > 3

  OR failed_attempts > 3

  OR payments_per_order > 2 
```

By tracking payment methods and patterns, we could identify accounts using multiple cards or displaying suspicious payment behavior.

**Shipping and Refund Analysis**
```SQL
 SELECT account_id

FROM orders o

JOIN refunds r ON o.order_id = r.order_id

WHERE unique_addresses > 3

   OR refund_percentage > 30

   OR suspicious_timing_count > 0
```

This combined shipping patterns with refund behavior to identify potentially fraudulent activities.

**The Comprehensive Detection System**

Our final solution combined all these elements into a sophisticated detection system. The complete query includes:

- Order velocity monitoring
- Payment pattern analysis
- Shipping behavior tracking
- Refund pattern detection
- Risk score calculation
```SQL
SELECT DISTINCT

    a.account_id,

a.email,

    a.creation_date,

    ov.orders_per_hour,

    ov.daily_total,

    ov.electronics_count,

    pp.unique_cards,

    pp.failed_attempts,

    sp.unique_addresses,

    sp.address_mismatches,

 rp.refund_count,

    rp.refund_percentage,

    rp.false_dnr_claims,

 -- Risk Score Calculation

 CASE

     WHEN ov.orders_per_hour > 3 THEN 30

     WHEN pp.unique_cards > 3 THEN 25

     WHEN sp.unique_addresses > 3 THEN 20

     WHEN rp.refund_count > 2 THEN 25

     ELSE 0

 END +

 CASE

     WHEN rp.false_dnr_claims > 0 THEN 30

     WHEN pp.failed_attempts > 3 THEN 20

     WHEN sp.address_mismatches > 0 THEN 15

     ELSE 0

 END as risk_score

FROM accounts a

LEFT JOIN order_velocity ov ON a.account_id = ov.account_id

LEFT JOIN payment_patterns pp ON a.account_id = pp.account_id

LEFT JOIN shipping_patterns sp ON a.account_id = sp.account_id

LEFT JOIN refund_patterns rp ON a.account_id = rp.account_id

WHERE

 ov.account_id IS NOT NULL

 OR pp.account_id IS NOT NULL

 OR sp.account_id IS NOT NULL

 OR rp.account_id IS NOT NULL

HAVING risk_score >= 50

ORDER BY risk_score DESC;

 ```

### The Bottom Line

Buyer's Clubs are the perfect haven for criminal activity. Most Machine Learning models or rule engines that rely on shipping address risk signals alone may miss account level details that indicate fraud, abuse, and criminal activity. To implement similar detection methods in your organization, start by establishing baseline metrics for normal buyer's club behavior. Gradually layer in the various detection components, adjusting thresholds based on your specific business context. Regular reviews and updates of the detection criteria ensure the system remains effective as fraudsters evolve their techniques.

Remember, the key to successful fraud detection isn't just in the technical implementation, but in understanding the broader context of how legitimate businesses operate and how fraudsters attempt to exploit them.

This framework serves as a starting point - adapt and modify it based on your specific needs and emerging fraud patterns in your industry.



A must-read blog written by a dear friend of mine in the fraud space, @NemeSys. Ever wondered how some people seem to rack up endless credit card points while making money on the side? Welcome to the fascinating (and somewhat controversial) world of Buyer's Clubs! 🧑‍💻💰


[First Guest Post!] Inside the Wild World of Buyer's Clubs: The Digital Gold Rush You've Never Heard Of


# What are InfoStealers?

Infostealers are a type of Malware designed to covertly steal sensitive information from infected devices. They’re commonly used by cybercriminals to harvest data that can be sold, used for further attacks, or leveraged in fraud campaigns. 

🧠 **What Do Infostealers Steal?**

Infostealers typically collect:

- Credentials (usernames, passwords, tokens)  
- Browser-stored data (cookies, autofill, session data)  
- System information (IP address, hardware details, installed apps)  
- Files and documents (especially from Desktop or Downloads folders)  
- Cryptocurrency wallet data  
- Chat and email logs  

---

🔥 **Why is Flare a Must-Have?**

Over a year and a half ago, my team integrated **Flare** into our tech stack, and it’s been a total game-changer.

## What Makes Flare Stand Out?

Right away, Flare impressed us with:

- The **most robust collection of infostealer logs** we've encountered  
- An intuitive and fun UI with **Light, Dark, Shrek, and Barbie Modes** (yes, really)  
- A rockstar support and engineering team that feels like the **1992 U.S. Olympic Basketball Dream Team** — Jordan, Magic, Bird — but with keyboards and terminal windows  

## How We Use Flare

Here’s how Flare integrates into our workflow:

### 🔍 Identify Persons of Interest

We regularly use Flare to investigate compromised identities. From credentials to alias accounts, we can pivot across accounts and link together behaviors across breached datasets.

### 🚨 Alerting for Domains

Set alerts for your organization's domains and get notified when they show up in infostealer logs. This enables proactive detection of exposed employees or infrastructure.

### 🔌 API Access

Flare’s API lets us:

- Pull leaked credentials  
- Pull leaked session cookies  
- Enrich our internal data clusters  
- Automate checks against newly exposed data  

### 💻 Infected Device Intelligence

With Flare, we can dig into:

- **All files pulled from an infected device**  
- Browser histories, session tokens, cookies  
- Autofill files (think saved usernames, addresses, and payment methods)  
- Telegram TData files  

From there, we can **build a map of compromised networks**, flag alias activity, and determine what websites, tools, or services were being used.

## Gold in the Browser History

Bad actors are shockingly bad at OPSEC when they shop online, they want their items delivered — so they use **real names and addresses**.

We’ve also seen:

- Google Translate logs revealing how non-English speaking actors communicate with buyers and collaborators  
- Evidence of forum activity, illegal service purchases, and file downloads — all on infected endpoints  

## No One Else Does This

Yes, there are other companies collecting breached data. But Flare is the only one we’ve seen that gives you **true access** to the raw data — and the tools to **investigate, correlate, and extract intelligence** from it.

Flare empowers our team to go far beyond alerts and actually **act** on threat intel.

If your team is serious about understanding and disrupting threat actor behavior, **Flare belongs in your arsenal**. 

Give their platform a try: hxxps[:]//try[.]flare[.]io/free-trial/. Let them know their #1 supporter, Cybercur, recommended them.




Is your organization locked in a constant battle against sophisticated threat actors targeting enterprise and customer accounts? Are you seeking greater visibility into how these actors gain initial access—often through compromised credentials, infostealers, or exposed assets? What if your team could not only detect these threats early but also attribute malicious activity and uncover the broader ecosystem behind it? Flare equips security teams with the intelligence they need to monitor, investigate, and disrupt threat actor operations—across the clear and dark web—in real time.


Flare[.]io – The Must-Have Tool for Your Tech Stack [Infostealer Malware]

A Python tool that scans Wayback Machine archives for sensitive information, API keys, and potentially dangerous files. Features include retry logic, rate limiting, and async support.

Threat Hunting on Wayback Machine [Python]


# 🕵️‍♂️ Threat Intelligence Dorking Tool
> 👨‍💻 Coded with curiosity by `cybercur@`

# 🔍 What is Google Dorking?

**Google Dorking** (also known as **Google hacking**) is a technique that uses advanced search operators to find information that isn’t easily discoverable through normal queries. It leverages Google’s indexing power to uncover hidden or sensitive data such as:

- 🛠️ Misconfigured servers
- 📂 Exposed files (e.g. `.pdf`, `.xls`, `.env`)
- 🔐 Login pages or admin portals
- 🗂️ Directories not meant for public access
- 🔓 Vulnerable devices or software versions

These searches are made possible using operators like:

- `site:` – search within a specific domain
- `filetype:` – search for specific file types
- `intitle:` – find pages with certain words in the title
- `inurl:` – locate keywords in the URL
- `intext:` – search for specific text within page content

---

# 🧠 Why is Google Dorking Important?

### 🔐 1. Security Testing
Pentesters and ethical hackers use dorking to simulate what a malicious actor might find — helping organizations identify and fix exposed assets.

### 📊 2. Open Source Intelligence (OSINT)
Investigators and analysts use it to uncover public data across websites, social platforms, and forums.

### 🧪 3. Vulnerability Discovery
Discovering misconfigurations, outdated software, or unprotected directories can help prevent real-world exploits.

---

# 🧰 How can this script help you?

Manually writing dorks over and over is inefficient and error-prone. A tool like **Threat Intelligence Dorking Tool** solves that by:

### ✅ Automating the Dork Creation
- No need to memorize syntax.
- Just select the type, fill in the fields, and it builds the query for you.

### 🌐 Multi-Engine Support
- Use Google, Bing, DuckDuckGo — or even dark web engines like Ahmia


## ⚙️ Features

- 🧠 Multiple dorking options:
  - `site:example.com keyword`
  - `filetype:pdf confidential`
  - `intitle:login`
  - `inurl:admin`
  - `intext:password`
  - `site:twitter.com breach`
- 🔍 Supports 20+ search engines
- 🌐 Supports dark web (.onion) search engines
- 🖥️ Built with a simple graphical interface using Tkinter
- 📤 Opens search in user's default browser (or warns if it's a `.onion` search)

---

## 🧠 Logic Breakdown

### 1. **Initialization**
- Creates a main `Tk` window.
- Sets title and size of the GUI.

### 2. **Dropdown Menu (Dork Type Selector)**
- Lets users pick from predefined dork types (e.g. `intitle:`, `inurl:`, etc.).

### 3. **Dynamic Input Fields**
- Based on the selected dork type, the app dynamically displays relevant input fields (e.g. website, file type, search terms).

### 4. **Search Engine Selection**
- For `site:` dorks, users can choose from a long list of search engines, including:
  - ☁️ Clear web: Google, Bing, DuckDuckGo, etc.
  - 🌑 Dark web: Ahmia, Haystak, Tor66

### 5. **Generate Dork Button**
- Concatenates the user’s input into a formatted dork string.
- Displays it in a scrollable text area.

### 6. **Open in Browser Button**
- Detects selected engine and encodes the dork string into a URL.
- Opens it in the default browser.
- 🛑 If the selected engine is a Tor-based `.onion` domain, it shows a warning message to ensure the Tor browser is running.

---

## 🔐 Use Cases

- 💼 OSINT Investigations
- 🧪 Penetration Testing
- 🔍 Vulnerability Discovery
- 👀 Social Media Intelligence

---

## 🚀 Example

If the user selects:

- Dork Type: `Search within a specific site`
- Site: `example[.]com`
- Term: `login`
- Engine: `Google`

The tool will generate: site:example[.]com login
And open: hxxps[:]//www[.]google[.]com/search?q=site%3Aexample[.]com+login

yaml
Copy
Edit


---

## 🧰 Requirements

- Python 3.x
- Tkinter (comes with most Python installs)

---

## 🧪 Want More?

You could easily extend this with:
- 📂 Export to file
- 📊 Import dork presets
- 🤖 Scrape and analyze results
- 🔒 Tor integration via SOCKS proxy

---


```python

import tkinter as tk
from tkinter import ttk, scrolledtext, messagebox
import webbrowser
import urllib.parse

class DorkGUI:
    def __init__(self, master):
        self.master = master
        master.title("Threat Intelligence Dorking Tool")
        master.geometry("900x700")

        self.create_widgets()

    def create_widgets(self):
        # Dork type dropdown
        ttk.Label(self.master, text="Select Dork Type:").pack(pady=5)
        self.dork_type = tk.StringVar()
        self.dork_choices = [
            "Search within a specific site",
            "Search for specific file types",
            "Search for pages with specific words in the title",
            "Search for pages with specific words in the URL",
            "Search for pages containing specific text",
            "Search social media platforms"
        ]
        self.dork_menu = ttk.Combobox(self.master, textvariable=self.dork_type, values=self.dork_choices, state="readonly", width=50)
        self.dork_menu.pack(pady=5)
        self.dork_menu.bind("<<ComboboxSelected>>", self.on_dork_select)

        # Frame for dynamic input fields
        self.input_frame = ttk.Frame(self.master)
        self.input_frame.pack(pady=10)

        # Text area for displaying generated dork
        self.result_text = scrolledtext.ScrolledText(self.master, wrap=tk.WORD, width=80, height=10)
        self.result_text.pack(pady=10)

        # Generate and Open buttons
        ttk.Button(self.master, text="Generate Dork", command=self.generate_dork).pack(pady=5)
        ttk.Button(self.master, text="Open in Browser", command=self.open_in_browser).pack(pady=5)

    def on_dork_select(self, event):
        # Clear previous input fields
        for widget in self.input_frame.winfo_children():
            widget.destroy()

        dork_type = self.dork_type.get()

        # Render inputs based on selected dork type
        if dork_type == "Search within a specific site":
            ttk.Label(self.input_frame, text="Website:").grid(row=0, column=0, sticky=tk.W)
            self.site_entry = ttk.Entry(self.input_frame, width=40)
            self.site_entry.grid(row=0, column=1, padx=5)
            ttk.Label(self.input_frame, text="Search term:").grid(row=1, column=0, sticky=tk.W)
            self.term_entry = ttk.Entry(self.input_frame, width=40)
            self.term_entry.grid(row=1, column=1, padx=5)
            ttk.Label(self.input_frame, text="Search Engine:").grid(row=2, column=0, sticky=tk.W)
            self.engine_var = tk.StringVar()
            engines = [
                "Google", "Bing", "Yahoo", "DuckDuckGo", "Baidu", "Yandex",
                "Ask", "Naver", "AOL", "Ecosia", "Startpage", "Qwant",
                "Swisscows", "Mojeek", "Gigablast", "MetaGer", "Oscobo",
                "Lukol", "Disconnect Search", "Searx",
                "Ahmia (Tor)", "Haystak (Tor)", "Tor66 (Tor)"
            ]
            self.engine_menu = ttk.Combobox(self.input_frame, textvariable=self.engine_var, values=engines, state="readonly", width=37)
            self.engine_menu.grid(row=2, column=1, padx=5)
            self.engine_menu.set("Google")

        elif dork_type == "Search for specific file types":
            ttk.Label(self.input_frame, text="File type:").grid(row=0, column=0, sticky=tk.W)
            self.filetype_entry = ttk.Entry(self.input_frame, width=40)
            self.filetype_entry.grid(row=0, column=1, padx=5)
            ttk.Label(self.input_frame, text="Search term:").grid(row=1, column=0, sticky=tk.W)
            self.term_entry = ttk.Entry(self.input_frame, width=40)
            self.term_entry.grid(row=1, column=1, padx=5)

        elif dork_type in [
            "Search for pages with specific words in the title",
            "Search for pages with specific words in the URL",
            "Search for pages containing specific text"]:
            ttk.Label(self.input_frame, text="Search term:").grid(row=0, column=0, sticky=tk.W)
            self.term_entry = ttk.Entry(self.input_frame, width=40)
            self.term_entry.grid(row=0, column=1, padx=5)

        elif dork_type == "Search social media platforms":
            ttk.Label(self.input_frame, text="Platform:").grid(row=0, column=0, sticky=tk.W)
            self.platform_var = tk.StringVar()
            platforms = ["Twitter", "Facebook", "LinkedIn", "Instagram", "Reddit"]
            self.platform_menu = ttk.Combobox(self.input_frame, textvariable=self.platform_var, values=platforms, state="readonly", width=37)
            self.platform_menu.grid(row=0, column=1, padx=5)
            self.platform_menu.set("Twitter")
            ttk.Label(self.input_frame, text="Search term:").grid(row=1, column=0, sticky=tk.W)
            self.social_term_entry = ttk.Entry(self.input_frame, width=40)
            self.social_term_entry.grid(row=1, column=1, padx=5)

    def generate_dork(self):
        # Build dork string based on input
        dork_type = self.dork_type.get()
        dork = ""

        if dork_type == "Search within a specific site":
            site = self.site_entry.get()
            term = self.term_entry.get()
            engine = self.engine_var.get()
            dork = f"site:{site} {term}"
            self.result_text.delete("1.0", tk.END)
            self.result_text.insert(tk.END, f"Your {engine} dork is:\n{dork}")
            return

        elif dork_type == "Search for specific file types":
            filetype = self.filetype_entry.get()
            term = self.term_entry.get()
            dork = f"filetype:{filetype} {term}"

        elif dork_type == "Search for pages with specific words in the title":
            term = self.term_entry.get()
            dork = f"intitle:{term}"

        elif dork_type == "Search for pages with specific words in the URL":
            term = self.term_entry.get()
            dork = f"inurl:{term}"

        elif dork_type == "Search for pages containing specific text":
            term = self.term_entry.get()
            dork = f"intext:{term}"

        elif dork_type == "Search social media platforms":
            platform = self.platform_var.get()
            term = self.social_term_entry.get()
            dork = f"site:{platform.lower()}.com {term}"

        self.result_text.delete("1.0", tk.END)
        self.result_text.insert(tk.END, f"Your dork is:\n{dork}")

    def open_in_browser(self):
        # Get final dork string from result box
        dork = self.result_text.get("1.0", tk.END).strip().split("\n")[-1]
        engine = self.engine_var.get() if hasattr(self, 'engine_var') else "Google"

        # If engine is .onion, warn the user
        if "(Tor)" in engine:
            warning = (
                "You're trying to use a .onion search engine.\n"
                "Please make sure the Tor Browser is installed and running.\n"
                "Would you like to proceed?"
            )
            if not messagebox.askyesno("Tor Required", warning):
                return

        # Define search URLs
        search_urls = {
            "Google": "https://www.google.com/search?q={}",
            "Bing": "https://www.bing.com/search?q={}",
            "Yahoo": "https://search.yahoo.com/search?p={}",
            "DuckDuckGo": "https://duckduckgo.com/?q={}",
            "Baidu": "https://www.baidu.com/s?wd={}",
            "Yandex": "https://yandex.com/search/?text={}",
            "Ask": "https://www.ask.com/web?q={}",
            "Naver": "https://search.naver.com/search.naver?query={}",
            "AOL": "https://search.aol.com/aol/search?q={}",
            "Ecosia": "https://www.ecosia.org/search?q={}",
            "Startpage": "https://www.startpage.com/do/search?q={}",
            "Qwant": "https://www.qwant.com/?q={}",
            "Swisscows": "https://swisscows.com/web?query={}",
            "Mojeek": "https://www.mojeek.com/search?q={}",
            "Gigablast": "https://www.gigablast.com/search?q={}",
            "MetaGer": "https://metager.org/meta/meta.ger3?eingabe={}",
            "Oscobo": "https://www.oscobo.com/search.php?q={}",
            "Lukol": "https://www.lukol.com/s.php?q={}",
            "Disconnect Search": "https://search.disconnect.me/searchTerms/search?query={}",
            "Searx": "https://searx.me/?q={}",
            "Ahmia (Tor)": "http://msydqstlz2kzerdg.onion/search/?q={}",
            "Haystak (Tor)": "http://haystakvxad7wbk5n.onion/search?q={}",
            "Tor66 (Tor)": "http://tor66sezptuu2nta.onion/search.php?q={}"
        }

        # Open in browser (Tor or normal)
        search_url = search_urls.get(engine, search_urls["Google"]).format(urllib.parse.quote(dork))
        webbrowser.open(search_url)

# Launch GUI
def main():
    root = tk.Tk()
    app = DorkGUI(root)
    root.mainloop()

if __name__ == "__main__":
    main()
```


This Python script creates a **desktop GUI application** using `Tkinter` that helps you quickly generate **search engine dorks**. It supports popular engines like **Google** and **DuckDuckGo**, and even includes **dark web search engines** like **Ahmia** and **Haystak**. Users can select a dork type, input relevant parameters, generate a dork string, and open the results directly in their browser (or Tor browser for `.onion` links).

Threat Hunting w/ Google Dorking [Python]


> 👨‍💻 Coded with curiosity by `cybercur@`
## 🔍 Problem [Domain Hijacking]
This is a tactic commonly observed in the e-commerce sector, where a threat actor gains unauthorized access to a victim's DNS control panel or hosting provider. With this access, the attacker can modify DNS records and create malicious subdomains to support further phases of their campaign.

### 💀 Why Would Attackers Create Subdomains?

| **Purpose**                        | **Example**                                     |
|-----------------------------------|-------------------------------------------------|
| Phishing                          | `login.example.com` mimicking a real service    |
| C2 communication (Command & Control) | `c2.example.com` to manage malware           |
| Credential harvesting             | `secure.example.com` as a fake login portal     |
| Spam or malware delivery          | `download.example.com` to serve malicious files |
| Persistence                       | Create DNS entries that aren’t easily noticed   |
| Abuse trust of root domain        | Leverage trust in `example.com` for deception   |


# 🧾 Subdomain Enumeration Tool 
My primary use case lies in threat hunting. I developed this script to aid in identifying not only the breadth of infrastructure associated with a campaign but also to surface behavioral patterns and linguistic clues—such as recurring terms or region-specific language usage—across subdomains.

The goal is to gain a more holistic view of the ecosystem behind an attack campaign, uncovering how threat actors structure and reuse their infrastructure when targeting our customers. If you do not have the ability to dev custom tools for your team, a powerful alternative for campaign tracking and infrastructure correlation is URLscan PRO, which offers rich contextual insights at scale.

## Source Code
```python
# Library imports for handling CLI args, networking, parsing, concurrency, and file operations
import argparse
import concurrent.futures
import dns.resolver
import requests
import re
import time
import random
import csv
import os
from bs4 import BeautifulSoup
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.retry import Retry

# ANSI color codes
G = '\033[92m'  # green
Y = '\033[93m'  # yellow
B = '\033[94m'  # blue
R = '\033[91m'  # red
W = '\033[0m'   # white

# Queries crt.sh for subdomains listed in SSL certificate transparency logs
def search_crt_sh(domain, max_retries=5, backoff_factor=2):
    url = f"https://crt.sh/?q=%.{domain}&output=json"
    session = requests.Session()
    retry = Retry(total=max_retries,
                  backoff_factor=backoff_factor,
                  status_forcelist=[429, 500, 502, 503, 504])
    adapter = HTTPAdapter(max_retries=retry)
    session.mount("https://", adapter)

    try:
        response = session.get(url, timeout=30)
        if response.status_code == 200:
            data = response.json()
            return set(item['name_value'] for item in data)
        else:
            print(f"{R}[!] crt.sh returned status code {response.status_code}{W}")
    except requests.exceptions.RequestException as e:
        print(f"{R}[!] Error in crt.sh search: {str(e)}{W}")

    return set()

def search_virustotal(domain, api_key):
    url = f"https://www.virustotal.com/api/v3/domains/{domain}/subdomains"
    headers = {"x-apikey": api_key}
    try:
        response = requests.get(url, headers=headers, timeout=10)
        if response.status_code == 200:
            data = response.json()
            return set(item['id'] for item in data['data'])
    except Exception as e:
        print(f"{R}[!] Error in VirusTotal search: {str(e)}{W}")
    return set()

def search_certspotter(domain):
    url = f"https://api.certspotter.com/v1/issuances?domain={domain}&include_subdomains=true&expand=dns_names"
    try:
        response = requests.get(url, timeout=10)
        if response.status_code == 200:
            data = response.json()
            subdomains = set()
            for cert in data:
                subdomains.update(cert.get('dns_names', []))
            return subdomains
    except Exception as e:
        print(f"{R}[!] Error in Certspotter search: {str(e)}{W}")
    return set()

def search_alienvault(domain, api_key):
    url = f"https://otx.alienvault.com/api/v1/indicators/domain/{domain}/passive_dns"
    headers = {"X-OTX-API-KEY": api_key}
    try:
        response = requests.get(url, headers=headers, timeout=10)
        if response.status_code == 200:
            data = response.json()
            return set(item['hostname'] for item in data['passive_dns'])
    except Exception as e:
        print(f"{R}[!] Error in AlienVault OTX search: {str(e)}{W}")
    return set()

def search_dnsdumpster(domain):
    url = "https://dnsdumpster.com/"
    headers = {"Referer": "https://dnsdumpster.com"}
    session = requests.Session()
    try:
        response = session.get(url, timeout=10)
        csrf_token = response.cookies.get('csrftoken')
        data = {
            "csrfmiddlewaretoken": csrf_token,
            "targetip": domain,
        }
        response = session.post(url, data=data, headers=headers, timeout=10)
        if response.status_code == 200:
            soup = BeautifulSoup(response.text, 'html.parser')
            return set(re.findall(r'([\w.-]+\.{})\b'.format(re.escape(domain)), soup.text))
    except Exception as e:
        print(f"{R}[!] Error in DNSDumpster search: {str(e)}{W}")
    return set()

def search_engine(domain, engine):
    headers = {'User-Agent': 'Mozilla/5.0'}
    if engine == "google":
        url = f"https://www.google.com/search?q=site%3A{domain}&num=100"
    elif engine == "bing":
        url = f"https://www.bing.com/search?q=site%3A{domain}&count=100"
    elif engine == "yahoo":
        url = f"https://search.yahoo.com/search?p=site%3A{domain}&n=100"
    elif engine == "baidu":
        url = f"https://www.baidu.com/s?wd=site%3A{domain}&rn=100"
    elif engine == "ask":
        url = f"https://www.ask.com/web?q=site%3A{domain}&qo=100"
    else:
        return set()

    try:
        response = requests.get(url, headers=headers, timeout=10)
        if response.status_code == 200:
            soup = BeautifulSoup(response.text, 'html.parser')
            return set(re.findall(r'([\w.-]+\.{})\b'.format(re.escape(domain)), soup.text))
    except Exception as e:
        print(f"{R}[!] Error in {engine} search: {str(e)}{W}")
    return set()

# Uses DNS to check if the given subdomain resolves to an IP address
def resolve_subdomain(subdomain):
    try:
        dns.resolver.resolve(subdomain, 'A')
        return (subdomain, True)
    except:
        return (subdomain, False)

# Orchestrates the enumeration process by querying multiple OSINT sources and resolving discovered subdomains
def enumerate_subdomains(domain, virustotal_api_key, alienvault_api_key, verbose=False):
    subdomains = set()
    search_functions = [
        ("Crt.sh", lambda: search_crt_sh(domain)),
        ("Certspotter", lambda: search_certspotter(domain)),
        ("AlienVault OTX", lambda: search_alienvault(domain, alienvault_api_key)),
        ("DNSDumpster", lambda: search_dnsdumpster(domain)),
        ("Google", lambda: search_engine(domain, "google")),
        ("Bing", lambda: search_engine(domain, "bing")),
        ("Yahoo", lambda: search_engine(domain, "yahoo")),
        ("Baidu", lambda: search_engine(domain, "baidu")),
        ("Ask", lambda: search_engine(domain, "ask")),
        ("VirusTotal", lambda: search_virustotal(domain, virustotal_api_key)),
    ]

    with concurrent.futures.ThreadPoolExecutor(max_workers=len(search_functions)) as executor:
        future_to_search = {executor.submit(search_func): (name, search_func) for name, search_func in search_functions}
        for future in concurrent.futures.as_completed(future_to_search):
            name, _ = future_to_search[future]
            result = future.result()
            subdomains.update(result)
            if verbose:
                print(f"{G}[+] {name}: Found {len(result)} subdomains{W}")
            time.sleep(random.uniform(1, 3))

    common_subdomains = ["www", "mail", "ftp", "webmail", "smtp", "pop", "ns1", "webdisk", "ns2", "cpanel", "whm", "autodiscover", "autoconfig", "m", "imap", "test", "ns", "blog", "pop3", "dev", "www2", "admin", "forum", "news", "vpn", "ns3", "mail2", "new", "mysql", "old", "lists", "support", "mobile", "mx", "static", "docs", "beta", "shop", "sql", "secure", "demo", "cp", "calendar", "wiki", "web", "media", "email", "images", "img", "www1", "intranet", "portal", "video", "sip", "dns2", "api", "cdn", "stats", "dns1", "ns4", "www3", "dns", "search", "staging", "server", "mx1", "chat", "wap", "my", "svn", "mail1", "sites", "proxy", "ads", "host", "crm", "cms", "backup", "mx2", "lyncdiscover", "info", "apps", "download", "remote", "db", "forums", "store", "relay", "files", "newsletter", "app", "live", "owa", "en", "start", "sms", "office", "exchange", "ipv4"]
    subdomains.update({f"{sub}.{domain}" for sub in common_subdomains})

    if verbose:
        print(f"{Y}[*] Resolving discovered subdomains...{W}")

    resolved_subdomains = []
    unresolved_subdomains = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
        results = list(executor.map(resolve_subdomain, subdomains))
        for subdomain, resolves in results:
            if resolves:
                resolved_subdomains.append(subdomain)
            else:
                unresolved_subdomains.append(subdomain)

    if verbose:
        print(f"{G}[+] Resolved {len(resolved_subdomains)} subdomains{W}")
        print(f"{Y}[+] Found {len(unresolved_subdomains)} unresolved subdomains{W}")

    return resolved_subdomains, unresolved_subdomains

def save_results_as_csv(resolved_subdomains, unresolved_subdomains, domain):
    desktop = os.path.join(os.path.expanduser("~"), "Desktop")
    filename = f"{domain}_subdomains.csv"
    filepath = os.path.join(desktop, filename)

    with open(filepath, 'w', newline='') as csvfile:
        writer = csv.writer(csvfile)
        writer.writerow(["Subdomain", "Status"])
        for subdomain in resolved_subdomains:
            writer.writerow([subdomain, "Resolved"])
        for subdomain in unresolved_subdomains:
            writer.writerow([subdomain, "Unresolved"])

    print(f"{Y}[*] Results saved as CSV: {filepath}{W}")

# Entry point of the script where command-line arguments are parsed and subdomain enumeration is initiated
def main():
    parser = argparse.ArgumentParser(description="Subdomain enumeration tool")
    parser.add_argument("-d", "--domain", required=True, help="Target domain")
    parser.add_argument("-o", "--output", help="Output file to save results")
    parser.add_argument("-v", "--verbose", action="store_true", help="Enable verbose output")
    parser.add_argument("--vt-api-key", default="", help="VirusTotal API key")
    parser.add_argument("--av-api-key", default="", help="AlienVault API key")
    args = parser.parse_args()

    print(f"{B}[*] Enumerating subdomains for {args.domain}{W}")
    resolved_subdomains, unresolved_subdomains = enumerate_subdomains(args.domain, args.vt_api_key, args.av_api_key, args.verbose)

    print(f"\n{G}[+] Found {len(resolved_subdomains)} resolved subdomains:{W}")
    for subdomain in sorted(resolved_subdomains):
        print(f"{G}{subdomain}{W}")

    print(f"\n{Y}[+] Found {len(unresolved_subdomains)} unresolved subdomains:{W}")
    for subdomain in sorted(unresolved_subdomains):
        print(f"{Y}{subdomain}{W}")

    if args.output:
        with open(args.output, 'w') as f:
            f.write("Resolved subdomains:\n")
            for subdomain in sorted(resolved_subdomains):
                f.write(f"{subdomain}\n")
            f.write("\nUnresolved subdomains:\n")
            for subdomain in sorted(unresolved_subdomains):
                f.write(f"{subdomain}\n")
        print(f"\n{Y}[*] Results saved to {args.output}{W}")

    save_results_as_csv(resolved_subdomains, unresolved_subdomains, args.domain)

if __name__ == "__main__":
    main()
```

## 🧱 Key Components

### 📦 Imports
Handles:
- Command-line arguments (`argparse`)
- Concurrency (`concurrent.futures`)
- HTTP requests (`requests`)
- DNS resolution (`dns.resolver`)
- Regex matching (`re`)
- HTML parsing (`BeautifulSoup`)
- File operations and CSV output (`os`, `csv`)

### 🎨 ANSI Color Codes
Defines terminal color codes for:
- ✅ Green (`G`)
- ⚠️ Yellow (`Y`)
- 🔵 Blue (`B`)
- ❌ Red (`R`)
- 🧾 Reset (`W`)

---

## 🔎 Subdomain Data Sources

Each of these functions queries a public source for subdomains:

| Function             | Source               | Description |
|----------------------|----------------------|-------------|
| `search_crt_sh`      | crt.sh               | SSL certificates |
| `search_virustotal`  | VirusTotal API       | Passive DNS |
| `search_certspotter` | CertSpotter API      | SSL logs |
| `search_alienvault`  | AlienVault OTX API   | DNS records |
| `search_dnsdumpster` | DNSDumpster          | DNS info (scraped) |
| `search_engine`      | Google, Bing, etc.   | Indexed subdomains |

---

## 🌐 DNS Resolution

- `resolve_subdomain(subdomain)`  
  Attempts to resolve the given subdomain using a DNS A-record lookup.

---

## 🤖 Enumeration Logic

- `enumerate_subdomains(...)`
  - Executes all search functions in parallel
  - Adds a predefined list of common subdomains (e.g., `www`, `mail`, `ftp`)
  - Resolves all discovered subdomains
  - Separates them into `resolved` and `unresolved` sets
  - Supports a verbose flag for live output

---

## 💾 Output Functions

- `save_results_as_csv(...)`  
  Writes subdomains with status (`Resolved` / `Unresolved`) to a `.csv` file on the user’s Desktop.

---

## 🧠 Main Function

- `main()`  
  - Parses CLI arguments like:
    - `-d` or `--domain`: Target domain
    - `-v` or `--verbose`: Show detailed output
    - `--vt-api-key`: VirusTotal API key
    - `--av-api-key`: AlienVault API key
  - Calls the enumeration and prints results
  - Optionally saves results to a file if `-o` is provided

---

## 🛠️ Example Usage

```bash
python subenum.py -d example.com -v --vt-api-key YOUR_KEY --av-api-key YOUR_KEY
```


This script performs **subdomain enumeration** for a given domain by using multiple OSINT (Open Source Intelligence) sources. It also attempts to resolve found subdomains using DNS and saves the results.

Latest Posts