Blog
Field notes from offensive security work, scraping research, and rate-limit investigations. Identifying details are changed for client confidentiality.
-
The Factory Floor That Wasn't: The ICS Census That Turned Into a Decoy Signal
Dressing an ordinary cloud server up as a power plant costs about four dollars and twenty minutes of an evening. Behind most of the industrial badges in this story there is no controller at all, just a rented Linux box wearing them. So the usual headline, that there is a scary amount of industrial gear exposed on the internet, is half right. There is a scary amount of something, and I wanted to map that something cleanly
-
The PLC That Was Never Real, Built So Nothing Underneath Would Give It Away
I put a fake water utility controller on the public internet to see who comes knocking on an exposed industrial box.
-
One Open Directory, a Self Extracting Alarm Killer, and the Room Where the Stolen Goods Become Money
I went looking for open directories handing out fresh built executables and walked into a rented Windows box in Frankfurt that was serving a whole toolkit in the open.
-
A Finance Lure, a Meduza Loader, and an XWorm Port Nobody Had Reported
Went looking for open directories serving built executables and found a finance themed hosting box with two binaries parked in the webroot. One of them turned out to be a native Windows infostealer and loader.
-
A Second Opinion on the Server That Said "pls input someting"
I rebuilt a finished cryptojacking investigation inside Silent Push to see if it held.
-
The Server That Said "pls input someting"
An open directory on a Beijing cloud was serving a cryptojacking takeover kit. One misspelled login prompt mapped the whole 27 server fleet.
-
Cloned VM Image, Three Cryptojacking Panels, One Delivery Chain
I was hunting something else entirely when I stumbled into a cryptojacking operation. Three IP addresses running PureMiner mining panels, all exposing their open directories.
-
The Page That Talks You Into Infecting Yourself
Starting with no leads, I found a live ClickFix campaign on Censys, a fake Cloudflare verification page that copies hidden PowerShell to your clipboard and walks you through running it. I mapped the 10 host cluster on Cloudzy, pulled the payload apart, and traced its dormant DGA C2. Honest about the two things I could not confirm.
-
What a Scan Can and Cannot Tell You
A follow up to the exposed vector database study. I loaded the scan data into BigQuery and measured what you can classify from scan data alone versus what needs an active probe. One signal is cheap to add. One gap cannot be closed by scanning harder.
-
The AI Writes Down Everything You Say, and Most of It Is Wide Open
The layer that logs what people actually say to their AI apps, the prompts and the responses, sitting on the open internet. I found 274 instances and 71 percent had no authentication at all. Enumerate only, nothing read.
-
The AI Remembers Everything, and a Lot of It Is Wide Open
A reproducible Censys based measurement of exposed Qdrant and Weaviate vector databases. 73.5% of reachable Qdrant instances required no authentication, with medical, legal, and financial data sitting open. Enumerate only methodology, no stored data accessed.
-
What I Built and Why
Why I built Phantom Feed, a browser based SQL workbench for practicing scraping and abuse investigations on realistic synthetic traffic. The gap it fills, what is in it, and who it is for.
-
A Practical Look at Scraping Behavior
How sophisticated scrapers shape their traffic to blend in, why single-signal detection fails, and which behavioral patterns still give them away when you stack signals correctly.
-
Bots and Scrapers: Motivations, Tactics, and Defenses
A field guide to who runs scraping operations, what they're after, and what realistic defenses look like beyond the obvious blocklist.
-
A Tale of Tokens, Cookies, and Curious Behaviors
A mobile-API rate limit that reset itself once a generic cookie was added to the request. The mechanics of why this happens and what rate-limit-key design choices invite it.
-
Rediscovering a Rate Limit Bypass: Cookie Header Strikes Again
A second encounter with a cookie-vs-token rate-limit bypass on a different platform, and what it tells us about how often this pattern recurs across the industry.
-
Bypassing Rate Limits Using The Host Header
Two domains sharing one backend but tracking rate limits separately. A simple Host header swap multiplied the allowable request budget.
-
Sandboxed Escaping
A sandbox test user that was supposed to be isolated turned out to have a quiet path into a sister platform's real user data. The token mechanics that made it possible.