DOD = Date of Disregard

RFN = Reason for Non-compliance (With industry standards)

DOM = Date of Mitigation

Refusal = Contact was made, the issue is understood, but refused to mitigate the vulnerability or vulnerabilities

Unresponsive = Attempts were made to notify the organization with no response or action taken on the domain to mitigate the issue

Inaction = Contact was made, the issue is understood, mitigation was promised, but no action to mitigate the vulnerability or vulnerabilities was made

All affiliated domains are believed to be under the umbrella of the parent organization.

I'm always looking at the DNS of any domain I come across for fun and I come across a lots of misconfigurations in regards to email security from the largest organizations to the smallest. Being that phishing is the #1 way to gain initial entry, and that it takes virtually 0 time and resources to get DNS right, I made this project listing domains with misconfigured DNS.

The ultimate goal of this project is to spread awareness about which domains are contributing to the global phishing problem and maybe if this project gets popular enough it will put pressure on those who refuse to change while being a good resource for organizations to better gauge risk when conducting business.

I basically take a look at the DNS of any domain I come across on the internet. If I see they have an email vulnerability I attempt to notify the organization and offer help with a screenshot of a POC. After around 2 weeks, if the problem isn't fixed or being addressed in some way, they get added to the list.

There is no order to the list. I will not add domains to this list that I have evaluated previous to 2022, the only domains that will be on this list are the ones notified during and after the year 2022. Those on this list are all contributing to the global phishing problem via a critical and easy to fix vulnerability (This type of vulnerability is "Critical" according to the OWASP Risk Assesment Framework, and is a 5.8 medium - 8.3 high on the CVSS calculator depending on who fills it out 😛 ). I will periodically update the list during my free time, it will slowly but surely grow.

Have any questions, concerns, suggestions, or potential additions to the list? Reach out to calamity#6391 on Discord or reach out via email here.

If you are on the list and have fixed the issue yourself please reach out via email here.

If you are on the list and need help fixing the issue please reach out via email here.

Email Spoof Test: https://emailspooftest.com is an email security pentesting suite that enables users to test and tune their connection level SMTP security posture anonymously and securely. The suite includes a guided test where you can generate a grade for the email security of your domains, the ability to test using custom email relays, the ability to validate spoofing with a spoofer, send pre-packaged real phishing templates that have been disarmed, and keep track of your progress with our Grade History tracker.

Spoofy: https://github.com/MattKeeley/Spoofy (Spoofy) is an open source and free tool for scanning large numbers of domains for DNS misconfigurations regarding email security. Spoofy is different from other mass DNS scanning tools because it prioritizes accuracy over speed, and custom manually tested spoof logic. (As seen in Zero-Point Security's CRTO course)

DLP Toolbox: https://dlptoolbox.com (formally Data Leak Test) is an auditing suite for testing and validating Data Loss Prevention (DLP) product policy functionality.  The suite includes a POST leakage test, a GET leakage test, file upload leakage test, and an email leakage test you can use to test and validate the ability for a DLP product to enforce their policies and prevent leakage.

Email Security Community (ESC): https://discord.gg/PmJP9ea4cz Here you can teach, learn, and discuss Email pentesting, Email security, and other Email related topics. Novices, experts, and everyone in-between are welcome to come explore the worlds #1 initial entry method with peers interested in the topic.

• Create social media for the Phishable project so people can be updated when the list is updated.
• Add more ideas to the ideas list
• Add links to my other projects