Disclosing.Observer

Summary: The leaked internal data of 4vps.su, a Russian-market VPS provider that also operates under the GIR brand, reveals a customer base that defies simple political narratives.

Summary: This post analyzes administrative activity in the leaked Media Land dataset and shows that provider-level behaviour is concentrated, shared across administrators, and embedded in the same access layer as customer operations.

Summary: DNS sinkholing is usually treated as the end point of an abuse campaign: a moment when malicious domains are neutralized and infrastructure disappears from view.

Summary: This post uses the leaked internal database of Media Land, a sanctioned bulletproof hosting provider, to reconstruct how its platform organised customers, subscriptions, virtual machines, and IP address space across billing, compute, and network…

Summary: Public-interest vulnerability disclosure depends not only on clear rules but on the moral character of those who apply them.

Summary: This post analyzes a cryptographic flaw in Pelmeni, a custom loader used by the Turla APT group to deploy Kazuar.

Summary: This blog explores three real-world cases—Citrix ADC (CVE-2023-3519), Cisco IOS XE (CVE-2023-20273), and Ivanti Connect Secure (CVE-2024-21893)—where patching alone failed to remove persistent backdoors from edge devices.

Being a CNA administrator means having access to something most people never see: zero-day vulnerabilities.

When I first became a CVE Numbering Authority (CNA) administrator at DIVD, I assumed most software vendors would welcome a heads-up about critical vulnerabilities in their products.

When I worked in a Computer Emergency Response Team (CERT), ransomware cases were part of the routine.