Catching typosquatting domains from certificate logs
Most fake domains obtain a certificate before they go live. That is a window to see the campaign before its …
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
How to read ransomware leak sites properly
Leak sites are a marketing channel, not a victim list. Taking their numbers at face value produces wrong conclusions.
The hard part of choosing keywords for dark web monitoring
Searching the company name is the easiest and least productive method. Yield lives in terms that are specific and hard …
Executive protection: the most expensive form of impersonation
Fake executive accounts exploit hierarchy, not a technical flaw. That is why technical controls do not stop them.
What goes into a geopolitical risk score?
Relations between states reshape the threat landscape directly. What makes a score useful is knowing which signal predicts what.
Hacktivist campaigns: noise or signal?
Most announced attacks never happen, and most that do are smaller than claimed. There is still something worth watching.