A security researcher writes about phishing detection, Signal privacy, threat intelligence, and information operations.
HN links it for practical phishing detection with Certstream and for its post on abusing Gmail to find unlisted email addresses.
If you are looking for a straightforward way to protect users from phishing, consider rewriting the URLS in their messages and check their clicks in real time against databases of phishing feeds.
You can check against - Google Safe Browser, Phishtank and other free phishing feeds if you don't have the money for real-time databases or proactive site scrapers.
This is one of the ways that we protect the end user from Phishing at https://www.phishprotection.com - part of the magic is to do a bunch of sanitization before accepting the message including strict SPF, DKIM, DMARC validation / virus protection at the edge / and watching the registration of SSL certificates for commonly exploited domains https://blog.0day.rocks/catching-phishing-using-certstream-97177f0d499a
If anyone is interested we rewrite URLs to match your domain name - something like linkcheck.yourdomain.com (protected by LetsEncrypt) and if you ever decide to leave you can export out the re-written URLs and redirect your domain to your own servers.
If you'd like to give it a try, feel free to let me know.
Certstream[0] is pretty cool. An great way to monitor for phishing domains[1]
[0] https://certstream.calidog.io/
[1]
https://github.com/x0rz/phishing_catcher
https://blog.0day.rocks/catching-phishing-using-certstream-97177f0d499a
Took a little while, but I think this is what you are looking for: https://blog.0day.rocks/abusing-gmail-to-get-previously-unlisted-e-mail-addresses-41544b62b2