Packages left for you
Dead Drops
A dead drop is where you leave something for someone to find later. Consider these packages left for you: two field exercises and one honest look behind the curtain. No fake "we've profiled you" theater here — the old web did that bit, and it was always a joke. This is the real thing, which turns out to be more useful anyway.
Drop 01
Profile yourself
An OSINT self-check, written as a field exercise. The goal: see what a stranger can learn about you in fifteen minutes, before a stranger does it for real.
- Check the breach lists. Run your email addresses through Have I Been Pwned. Every hit is a password you must change now, plus a reminder to stop reusing them.
- Google yourself like an enemy would. Your name, your handles, your old usernames — in quotes, one at a time. Then try them on Marginalia; the small-web engine finds forum posts the big ones buried.
- Audit your social profiles' public face. Open each profile in a private window while logged out. That's what the world sees. Old photos, tagged locations, "about me" bios from 2011 — prune or lock down whatever surprises you.
- Map your own domain. If you own a site, run it through crt.sh and see every subdomain the certificate logs reveal. Attackers do this to find your forgotten staging servers; you should find them first.
- Write down what you found. Seriously — a one-page "exposure report" on yourself, updated yearly. Knowing your own footprint is the difference between a scare and a disaster.
House rule: do this exercise on yourself. Profiling other people without their knowledge crosses from curiosity into creeping — and in many places, into illegality. The tools are neutral; your target selection isn't.
Drop 02
Read a URL like an investigator
Most phishing succeeds because people click first and read later. Flip the order.
- Hover before you click. The status bar (or a long-press on mobile) shows the real destination. If the text says "your-bank.com" but the link goes somewhere else, walk away.
- Read the domain right-to-left. In
secure-login.example.com.evil.ru, the registrable domain isevil.ru— everything before it is decoration. Train your eyes to find the true rightmost domain. - Expand shorteners safely. A bare
t.coorbit.lylink is a wrapped package. Detonate it remotely with urlscan.io instead of clicking — you get a screenshot and a full request log. - Check the domain's age and owner. A "bank" whose domain was registered last Tuesday is not a bank. Public whois and RDAP lookups are free; a domain younger than the story it's telling is a red flag.
- Watch for punycode trickery. Attackers register lookalike domains using foreign alphabets — a Cyrillic "а" that looks exactly like a Latin "a". When a URL looks right but feels wrong, paste it into a punycode decoder and look for the
xn--giveaway.
Drop 03 — the honest version
What this site can see
The old portals loved a theatrical "WE KNOW WHO YOU ARE" page. Here's the grown-up version: a live readout of exactly what your browser volunteers to this page — and a plain-words explanation of what each bit means. No tricks, no logging, nothing leaves your machine.
| Signal | What your browser sent |
|---|---|
| Reading the signals… (needs JavaScript) | |
And what we don't see: your paste contents. Pastes on the Tools page are encrypted in your browser before anything leaves it, and the site does not see the plaintext. What has changed: a visit to the Tools page itself is now counted by Google Analytics 4, like every other page on this site. Analytics records the page visit, not your paste contents. See the Privacy page for what GA4 collects and how to opt out.