Dead Drops

Drop 01

Profile yourself

An OSINT self-check, written as a field exercise. The goal: see what a stranger can learn about you in fifteen minutes, before a stranger does it for real.

1. Check the breach lists. Run your email addresses through Have I Been Pwned. Every hit is a password you must change now, plus a reminder to stop reusing them.
2. Google yourself like an enemy would. Your name, your handles, your old usernames — in quotes, one at a time. Then try them on Marginalia; the small-web engine finds forum posts the big ones buried.
3. Audit your social profiles' public face. Open each profile in a private window while logged out. That's what the world sees. Old photos, tagged locations, "about me" bios from 2011 — prune or lock down whatever surprises you.
4. Map your own domain. If you own a site, run it through crt.sh and see every subdomain the certificate logs reveal. Attackers do this to find your forgotten staging servers; you should find them first.
5. Write down what you found. Seriously — a one-page "exposure report" on yourself, updated yearly. Knowing your own footprint is the difference between a scare and a disaster.

House rule: do this exercise on yourself. Profiling other people without their knowledge crosses from curiosity into creeping — and in many places, into illegality. The tools are neutral; your target selection isn't.

Drop 02

Read a URL like an investigator

Most phishing succeeds because people click first and read later. Flip the order.

1. Hover before you click. The status bar (or a long-press on mobile) shows the real destination. If the text says "your-bank.com" but the link goes somewhere else, walk away.
2. Read the domain right-to-left. In secure-login.example.com.evil.ru, the registrable domain is evil.ru — everything before it is decoration. Train your eyes to find the true rightmost domain.
3. Expand shorteners safely. A bare t.co or bit.ly link is a wrapped package. Detonate it remotely with urlscan.io instead of clicking — you get a screenshot and a full request log.
4. Check the domain's age and owner. A "bank" whose domain was registered last Tuesday is not a bank. Public whois and RDAP lookups are free; a domain younger than the story it's telling is a red flag.
5. Watch for punycode trickery. Attackers register lookalike domains using foreign alphabets — a Cyrillic "а" that looks exactly like a Latin "a". When a URL looks right but feels wrong, paste it into a punycode decoder and look for the xn-- giveaway.

Drop 03 — the honest version

What this site can see

The old portals loved a theatrical "WE KNOW WHO YOU ARE" page. Here's the grown-up version: a live readout of exactly what your browser volunteers to this page — and a plain-words explanation of what each bit means. No tricks, no logging, nothing leaves your machine.

Live readout — generated locally in your browser, sent nowhere.

Signal	What your browser sent
Reading the signals… (needs JavaScript)

And what we don't see: anything from the colophon still holds — no trackers, no cookies, no analytics, no server logs with your name on them. A site that wanted to identify you would need far more than this page asks for, and this page asks for nothing.