TCIP T0 USA, AUS, CAN, GER, NZLH20291123

- June 2009

-
TOP SECRETHCOMINTHREL TO USA, AUS, CAN, GER, NZLH20291123

 

 TU USA, AUS, CAN, GER 

Email Addresses 

?u 

 
 

 

 

The Email Address search allows you to search
on:
. Full Email Address

Do not search on/wildcard JUST the username, always
include a specific domain

. Foreign-hosted domains (eg. @cnc.cn)

The query searches within bodies of emails,
webpages and documents guessed
it). . . Email Addresses

I To, From, CC, BCC lines..
I ?Contact Us? pages on websites
I Signature blocks

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

  . 
Ill 1 I 
Eail ddress

Email Addresses are found in many parts 0
traffic

   

 

 

  

 

 

 

     
       

Eihll Display Haw Data DHI Farmat 
Subject: RE:
Fram:
Ta: 
Cc:
Data: LJE Jun 23 12:41:25 GMT 

 

 

 

 

 miaa mama 
XKEYSCORE has picked a
up traffic with email
addresses in it..

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 
 

Email Address

TU USA, AUS, CAN. GER.- NZL -- Ill

 
 'a 

 

 

 

Subject:

Frem:
Te:

Ce:

Date:

 

 

lenisplay I eaw Data DHIFermat

Attachments:

 

 

RE: Malaysia Tax

 

 

Tue Jun 23 12:41:25 GMT EDDEI
[Illirr?raaelillillipa [12013 lattes];

 

 

 

 

 

EEC Seesinn viewer

- 's  1*

Detetirne Netetien Frern Te 

entrees-ea 12:41:2e lee?[E United States} 219_ (E Malaysia} sees? a

TD 

til:

433E

 

 

 

 

 

 

 

 

 

 

Header l3]  attachment 53?? Meta 


 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

EV

 

 

 

teeh.html applieatinn_id.sml phnne_numher.html

email 

 

 

 

 

 

 

    

LJei ermetter

 

  

 

XKEYSCORE parses out everything it ?thinks? is
an email address, so don"t be fooled by mis?hits

 

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

   

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL I

1 Creating Email Address Queries

 

 

 

 

 

Enter usernames and domains into query

Search: Email Addresses

 

 



ecii in item sample

 

Query Marne:

 

Justi?eatien:

 

 

 

 

?dditienal Justi?eatien: 1r

 

 

 

Miranda Number:

 

 

 

 

 

 

 

 

 

 

 

 

Datetirne: l?ay Start: senses-as IE3  aa:an amp: 2
Email Use@ badge}! er baddudei er badguysernail 
@Demain: 

 

 

 

 

Mulitiple usernarnes frem
Subject: SAME domain can be 

 

 

 

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL

Creating Email Address Queri?

 

 

 

 

 

BE VERY CAREFUL of OR?ing domains

 

Search: Email addresses

 



Justi?cation:

additional Justi?cation:

Miranda Number:

 

 

 

PEPE: in 3 la

 

 

 

 

 

When working with multiple
domains, create separate
EmailAddress queries for
each. i.e. Group your
queries by domain names.

 

 

"ii"

 

 

 

 

 

 

 

 

Datetime:

[Slayr 

 

Email Usarname:

 

Start; loosens?23 



A.
loops Etc-p:

 

 

 

padguy or baddudei or padguysemail

 

 

 

 

@main:

Subject:



 

 

or hotmailoom 2 I

 

 

Mulitiple domains means

 

 

either badguy@yahoo.eom

 

 

 

 

or badguy@hotmail.com.
Are both your targets?

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL

Email Address

Sample Search: baku@huawei.com

 

 

 

 

 

 

 

Search: Email Adar-655125

Query Narnia:

Jus??ca?an:

additianal Juati?catian:

Miranda Number:

Datatima:

Email Uaarnama:

@Damain:

 

 

 

 

 



 

 

 

 

 

 

 

 

 

1 Weak



 

 

Start: El anal: St

 

 

baku

 

 

 

huawaiaam

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL

Email Address

    

 

 

 

 

Email Addresses are found in many parts of

ESE

traffic a

 

 

DNI [lisp-lay,r Haw Data  UNI 

a HTTP Header lnferrnatien CnntentTy'ne: HiTF'iHTltilL

 

Services 1

 

 

 

Fax: 13533

 
  

Vie-1111a, Austria 

Baene Of?ce Building, 4th Fleen? Tali T, Brnet- Caapian Plaza llCentre ,blaeli
It], l?li] ?i-Tieinia, Hnatria Azerbaij an. 32112165

m" i? 1 1 mm? Tel: 
Results here are from Faa: ??99412-51?-5944

30 30 ewi r] a we [33  ail: 
that contained the email
ad resa

Iii-611, J.Jahhar1?.r St. Bale

 
   

   
   

 

 

 
 

 

 

 
 

 

 

 

 

aln'ain, aln'ain

 

Building 1547, Read 23113eef Dietriet 4231<lingtleni ef Bahrain ?i-Tilla Hill, Ii-Iehanletlia Garden, Gate N?j??ead
Tel: Ne.3431,Bleele 

Fax: UUQTJ-ITEEBTUI Tel: 

Dhaka, Bangladesh I'ilelir-ili, Belarus

Centereli?nil gulelian Avenue Gulellan Mariel Kerelya atr._.51_. Hear-2, effiee-EE, Ii-ilinel-aBelanie
T?li-rais-n 1"}1 I nn 1'7: 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 To USA, AusUser Activity query is based on APPRO 
collection (such as chat, webmail, etc)

Allows more flexible search criteria than
Email Address query

- Can search on: Cookies, numeric logins 
web forums OSN), VolP selectors, webcam
first images, Webmail profile information from
registration (birthdays), general usernames

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 

Creating User Activity uerie

 

 

 

 

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL I

 

The fields in a User Activity query can be

 

Datetime: Start: El Stup: 
Bearer: For: 
Search value: 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Realm:

 

 

 

Attribute Type:

 

 

 

 

ettriljute t#alue:

 

 

 

activity:

Enurce:

 

 

IP 

 

Frern tr

 

 

 

 

 

 

 

Enter target
selecterslidentifiers here:

-Phene Ne
-Ceekie

?UsernamefE V AD (then
add REALM)

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 TU use?! we;
. I .

 
  
 

reati 9 Act i vi we ti 

 

 

 

 

The fields in a User Activity query can be

00 nfu 3  9
Health Fer Seetehtielue l?ltltiltute Tyree etlriltute iielue 
ueerneme Eyeltee eelnntunieente ?eeiltlee :ietl'lei' 

    
  
  
  
  
  
  
   
 
 

 

 

 

 

 

 

 

 

ueerneme agent-tee eenteet_liet ELSHW :15 
ueerneme ?yehee {lireetien eewer-te-elient i
ueerneme gem?me rem 
"?emme Emmi" Notice partial email addresses in the
ueernenle ?gyeltee rew_ netetlete ?Search Value" field"

ueerneme ?yeltee i
ueerneme tj?gyeltee leer_reelnt 
ueerneme ?yehee whee 
ueerneme Eltl?iI-Fttlilr ?njyeltee i
ueerneme 

?yehee ttll?? 

TDP

GR HCDMIHTHRELTD USA, AUS, CAN, GER, NZL

   

 SECRETHCUMINTHHEL TU USA, AUS, CAN, 

Creating User Activity neg:

 

   

 

a Scenano:
You have a target?s email address:

- _@h0tmail.com

Known: One email address

:1 Unknown: Alternate lD's, lPs, Location, Photo,
(lots of stuff)

Where do we begin?

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL

lwant 

     

 

 

 

 

have an Email Address and want to see if it?s being collected?
I Do an Email Address query on username and domain

 

 

 

 

Email Uaemame: 

 

 

 

 

@Domain: huaweicom

 

 

 

 

- Do a User Activity query on the email address in the ?Selector Value?

 

 

 

 

Search Value: hakur?huaweiw

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 
 

I have a Cookie and want to see what other accounts access this

computer
I Do TWO separate User Activity query on the cookies

 

attribute Li-ialue:

Search For
usernanle













 

 

SECRETHCUMINTHHEL TU USA, AUS, CAN, 

"IWant to. . ..

b.
.

 

 

 

 

dg?a?od4u?h4

 

 

  

lue

Search

  
 

  
 

rlg?utiorlziuifilizi

_ymnw


  
 

  
 

 
 

   
  


Egon-Hie
y?ltoo?coohie
yaltooEc-ool-Iie
E_coohie
E_cookie
H_coohie

yaltooElic-oolrie

 

TDP 

 

Brings back THESE

Attribute yalue res?  

 

 

 

tlg?u?mldu?lid

tlg?q?mldu?lid

lg?uumldu?lid

tlg?uumldu?lid

tlg?u?mldu?lid


Notice redundancy. So you MAY miss traffic

  
  

  
  
  
  

 
 
 

if you select ?B_cookie? or ?yahooBcookie?

(don?t know why)

 

 

 TU USA, AUS, CAN. GER.- NZL I [El

,lwant to 

 

   

 

have a Cookie and want to see what other accounts access this
computer

I Do TWO separate User Activity query on the cookies

 

 

 

 

 

 

 

 

 

-  Eeereh yelue: dgaq?odaluljliai

 

 

 

Brings back THESE


 

 

 

  
     

 

Search For Search y'alue Attribute Type 1 Ihute yelue
yahoo
userllanle t-lg?alilot-ldulillid yahoo

username yahoo

username t-lg?a?ot-ldu?lid yahoo
userllame yahoo
userllanle t-lg?a?ot-ldu?lid yahoo
yahoo

 

if you select ?B_cookie? or ?yahooBcookie?
(don?t know why)

 

 

TDP 

 

 

 SECRETHCUMINTHHEL TU USA. AUS, CAN, GER. NZL

Iwant 

 

 

have a Cookie and want to see what other accounts access this
computer

I Do a Marina query on the cookie as well (why not)?

 

 

 

 

 

Specify D313: E31136 "e {a

{?rva [hlumnss]}: Date

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Fer User Streng Selectera (Emma, IDS. Elena-Meg, Mail Taker?is, Prue-rue

 

 

emaetljf mat-eh 
121'?: dgEl 

 

 

 

 

 

 

Iit is neweat data if ra?w 111etatlata result limit)
'where value is

 

 
  
   

 

filter 

L: unitli?nn lBrit-aria

 

 

 

 

*Elu'ivelunveut ?ll-?eas: C3 All Meme Helen:

 

 

Quei?v Insti?eatie? iranian la ir?I eefahar?i

 

Submit  I I

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL  

I. lwant to. 

     

 

I have a Cookie and want to see what other accounts access this
computer

I Do a Marina query on the cookie as well (why not)?

 

 

 

USEILA ACTIVITY 

_?.rahoo13* ans-E11 with machine JIJ 
seen with ma chine JIJ tlg?q?otlmi?iiwiyahooBcookie?) 
-?.rahoo13* seen with ma chine 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 SECRETHCUMINTHHEL TU USA, AUS, CAN, GEIR, MEL

  
  
 

 Want to. . . . 

 

 

So let?s put the cookie query all 
I Between Marina and XKS, I should have an idea of all the accounts.

a Results pulling on ngqOed4uO i4 as a Search Value

Search Far Search Value Attribute Type Value 
usernaln-e yell-1e ?cl'lj.rallee
Ilsernalne yalme ?tyalme

ll?i?l'll?l'll? Et?il?t? 

 

 

a Plus my Marina results
ACTIVITY USERJE C??-I?ll

 

        

Iyahee?? .en with maehine 1D 

seen witl'l 111aehine JIJ 

?=It_iraheei=? seen with maehine JIJ 

 

 

RESULTS: Three users an the a computer..

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, MIL

I want 

     

 

 

 

 

have an IP address and want to know what users/accounts are
collected in that network? a Cafe?s IP address, or mail/web
server for an organization)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

- Do an Email Address Email Usernarna:
query on the IP address 
Subject:

address:  From 

 

 

 

 

 

 

 

CFarrth 

I Do a User Activity query 
on the IP address 

 

 

 

 

 

 

 

attribute Tyne I 

 

 

 

 

Li?alue

 



 

I 

address: 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

 

 TU USA, AUS, CAN, GER, NZL  II 3'

Moral of the story

 

 

 

 

Email Address query looks for the symbol in
traffic

User Activity search allows you to query on
more than just an email address

 

 

 

 

 

TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL