Privacy & Security Guides

Practical, education-first guidance for protecting your privacy and staying safe online.

• How to Analyze DNS Records for Security A practical guide to reading DNS records for security purposes: understand A/AAAA/MX/NS/TXT/CNAME, check SPF and DMARC in TXT records, and spot common misconfigurations.
• How to Analyze Email Headers Safely Learn to read email headers to spot phishing: inspect From vs Reply-To, the Received chain, and Authentication-Results (SPF/DKIM/DMARC), all locally in your browser.
• How to Analyze an Indicator of Compromise (IOC) A practical workflow for analyzing IOCs: identify the type, normalize and defang, check against threat intelligence, and avoid the trap of treating 'no record' as 'safe'.
• CVE Patch Triage Checklist — From CVE ID to Patch Decision An actionable checklist for deciding what to patch first: confirm the CVE and affected product/version, check KEV and exploitability, weigh exposure and business impact, assign a patch priority, apply mitigations, and verify — connected to CVE lookup, KEV data and the investigation workspace.
• How to Build a Cyber Intelligence Workflow Turn daily cybersecurity alerts into an actionable intelligence routine: collect, triage, verify, correlate, investigate and report — using OpenTrojan's daily intelligence, entity pages, tools and investigation workspace.
• Data Exfiltration Investigation Guide How to investigate suspected data exfiltration: volume anomalies, outbound funnel, and correlation of network, endpoint and account telemetry.
• How to Decode JWT Safely Decode JWTs safely without uploading them: understand what decoding reveals, why decoding is not verification, and what claims to inspect (alg, exp, iss, aud, sub) for API security review.
• Identity & MFA Security Checklist — Lock Down Every Sign-In An actionable checklist to harden identity and access: require phishing-resistant MFA everywhere, enforce password and recovery hygiene, review sessions and OAuth grants, protect privileged accounts, and monitor sign-in signals for compromise — with verification steps and references.
• Incident Response Playbook An action-oriented incident response playbook covering preparation, detection, containment, eradication, recovery and lessons learned.
• How to Interpret Hash Checker Results — Hash Match vs. Hash Verdict How to read a Hash Checker result correctly: what an MD5/SHA-1/SHA-256 value tells you about a file, what a clean or known-malicious match means, limitations and false positives, and how to escalate a hash into a full investigation.
• How to Interpret IOC Lookup Results — What a Record (or No Record) Means How to read an IOC Lookup result correctly: what a matching record means, what no record means, false positives, confidence, and when to escalate to a full investigation. Never treat an indicator lookup as a threat verdict.
• How to Interpret URL Reputation Results — What Safe and Unsafe Mean How to read a URL Reputation result correctly: what a clean, suspicious or malicious rating means, what it does not mean, false positives, confidence and when to escalate to a full investigation. A reputation check is a starting point, not a verdict.
• How to Investigate a CVE — Evidence-Based Triage A step-by-step method for investigating a CVE: verify the record, assess severity and CVSS, check exploit status and CISA KEV, identify affected products and fixes, then continue to evidence and investigation.
• How to Investigate Malware An evidence-led workflow for investigating a malware family: establish identity and attribution, understand behavior, map techniques, find IOCs, and connect the intelligence to detection and investigation.
• How to Investigate a Threat Actor An evidence-led method for investigating a threat actor: gather attribution, map techniques, connect campaigns and CVEs, then evaluate confidence and build an investigation.
• Log4Shell Investigation Playbook — Evidence-Based Triage A step-by-step investigation playbook for Log4Shell (CVE-2021-44228): understand the flaw, find affected systems, collect indicators, validate exposure, detect exploitation and plan mitigation — with real tools and an investigation path.
• Malicious URL Analysis Playbook — From Link to Verdict A step-by-step playbook for analyzing a suspicious URL: extract and defang the URL, check reputation, resolve DNS, examine the page, collect indicators, investigate the infrastructure, and reach a defensible verdict with real tools and an investigation path.
• Malicious URL Investigation Guide How to investigate a suspicious URL: static parsing, redirect/decode analysis, reputation and safe triage without visiting the target.
• How to Manage Passwords Securely Practical password security: use a password manager, create unique long passphrases, enable 2FA, avoid reuse, and learn why 'strong but reused' is still a risk.
• Phishing Defense Checklist — Verify Before You Trust an Email An actionable, step-by-step checklist to triage a suspicious email before anyone clicks: check sender identity, header and authentication signals (SPF/DKIM/DMARC), inspect domains and URLs safely, extract indicators, and decide whether to block, quarantine, report or escalate — with the tools to do it locally.
• Phishing Email Investigation Playbook — From Header to Verdict Step-by-step phishing email investigation: read the headers, validate sender authentication (SPF/DKIM/DMARC), analyse sender and domain, dissect URLs safely, extract IOCs and decide next steps — using local tools only.
• Privacy Basics — Getting Started A practical starting point for protecting your online privacy: passwords, 2FA, updates, and mindful sharing.
• How to Read the CISA KEV Catalog Understand the CISA Known Exploited Vulnerabilities catalog: how to read entries, why KEV matters more than CVSS score alone, what due dates mean, and how to prioritize remediation.
• Secure Communication Guide Learn how to communicate securely with end-to-end encryption, verify identities, and avoid common interception risks.
• System & Network Hardening Checklist An executable hardening checklist across the Prevent / Harden / Verify domains: configuration, patching, access and verification actions.
• Suspicious Domain Investigation Guide How to investigate a suspicious domain name: registration, DNS, reputation, relation to known threats, and recommended tools.
• Suspicious IP Investigation Guide How to investigate a suspicious IP address: reputation, geolocation, passive DNS, port/service posture and linked infrastructure.
• Threat Detection & Response Checklist An executable checklist for detecting, triaging and responding to security events — before, during and after.
• Base64 Encoder/Decoder — How to Use Safely Use the OpenTrojan Base64 tool to encode/decode Unicode-ready standard and URL-safe Base64 locally for inspecting payloads and quick data transport.
• CVE Lookup — How to Use and Interpret Results Use the OpenTrojan CVE Lookup tool to read severity, CVSS score, affected products, CISA KEV status and references for a vulnerability, and decide a patch priority.
• DNS Lookup — How to Use and Interpret Records Use the OpenTrojan DNS Lookup tool to query A/AAAA/MX/NS/TXT/CNAME and surface missing SPF/DMARC, and read the results for email and DNS security.
• Email Header Analyzer — How to Use and Read Results Use the OpenTrojan Email Header Analyzer to parse From/Reply-To, Received hops and SPF/DKIM/DMARC locally, and spot phishing signals in a message.
• Hash Checker — How to Use and Interpret a Match Use the OpenTrojan Hash Checker to fingerprint MD5/SHA-1/SHA-256 file hashes, check known threat-intelligence hashes, and understand what a match means.
• Security Headers Checker — How to Use and Read HPKP/CSP/HSTS Use the OpenTrojan Security Headers checker to passively probe a site's CSP, HSTS, X-Frame-Options response headers and see hardening gaps.
• IOC Lookup — How to Use and Read a Hit Use the OpenTrojan IOC Lookup tool to normalize and check IP, domain, URL and hash indicators against the intelligence store, and read what a match does and does not prove.
• IP Reputation — How to Use and Interpret a Check Use the OpenTrojan IP Reputation checker to validate an IPv4/IPv6 address and compare it against threat-intelligence records, and read a hit with the right caveats.
• JWT Decoder — How to Use and Inspect Claims Use the OpenTrojan JWT Decoder to decode JWT header and payload locally, inspect claims, and stay safe — signature is never verified and no secret is needed.
• Password Strength Checker — How to Use and Read the Estimate Use the OpenTrojan Password Strength tool to estimate password strength from entropy and common weak-password heuristics, and understand how to improve it.
• URL Analyzer — How to Use and Read the Parse Use the OpenTrojan URL Analyzer to parse a URL's structure locally, surface obfuscation and phishing signals, and decide whether to check its reputation.
• URL Reputation — How to Use and Interpret a Check Use the OpenTrojan URL Reputation checker to normalize a URL and compare its domain against threat-intelligence records, and weigh a hit responsibly.
• How to Use OpenTrojan for Daily Intelligence A starter routine for making OpenTrojan part of your daily security workflow: check daily intelligence, follow the entities you care about, use tools to verify, and ask the AI assistant for grounded answers.