Validin is a next generation internet intelligence platform.
Southeast USA
Joined May 2017
- Tweets814
- Following473
- Followers2.3K
- Likes1.1K
Pinned Tweet
For analysts and researchers: releasing a new advanced search query language and Search Sessions. Read the announcement:
validin.com/blog/validin_int…
Using Validin's Open Directories, a researcher uncovered an attacker's NetScaler exploit toolkit, revealing C2 infrastructure, exploitation techniques, and IOCs.
Discover attacker tooling, intent, and evolution with Validin's Open Directories.
mokki.sh/posts/2026-10-08-cv…
Validin retweeted
To investigate this campaign, we used @anyrun_app to capture the gated delivery chain in action and @ValidinLLC to map the infrastructure behind it.
Validin retweeted
New Okta Vishing Theme: "Contact"
Themes switching: support -> claims -> report -> contact
Hunt for:
- contact-{org}.com
- {org}.contact
Tracked through @ValidinLLC
Validin retweeted
Coffee break - back soon!
Thanks to our friends @ValidinLLC for keeping us all fueled.
Validin retweeted
H/t again to @ValidinLLC and @500mk500. We got some great pivots through banner hashes and bouncing finds off maltrail.
Also some white glove assistance from @SreekarMad.
Hijacked YouTube channels are pushing an emerging infostealer.
We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.
The stealer itself is built for long-term operation:
- Sandbox scoring: 10 weighted checks, self-terminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.
Our team observed 4 follow-on modules that haven't been publicly documented until now.
Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: go.es.io/4iJZRQe
Whitepaper: go.es.io/4xcanmZ
Validin retweeted
🫡 A strong LABScon salute to our partners at Validin for their generous support of the conference!
🔬 Validin is an internet intelligence and threat-hunting platform that helps security teams uncover and track malicious infrastructure using DNS, host and certificate data. @ValidinLLC
👉 Explore: validin.com/platform
Researching 3 clusters recently reported by GTIG to find unreported fake banquet invitations, Google Drive links, and more.
Inhospitable: Tracking Russian Cyber Espionage Infrastructure validin.com/blog/inhospitabl…
❤️
I've probably said it before, but @ValidinLLC is seriously one of the most useful and underrated threat intel tools out there.
Validin retweeted
A Security Conversations interview with Kenneth Kinion, CEO at threat-intelligence firm Validin @ValidinLLC
open.spotify.com/episode/3ar…
Validin retweeted
7/16/26 packetwatch.com/resources/be… - This case study shows how to investigate malicious traffic and a threat actor's infrastructure, IP addresses, and domain indicators of compromise.
#validin @ValidinLLC #threatfeed #threatintelligence #threathunting #cybersecurity #cyberincidents #cyberattack #dfir #networksecurity #informationsecurity #teamsixty43
ALT Case Study: PacketWatch and Validiin
PacketWatch, a network threat-hunting and managed cybersecurity company, has both a research workflow and direct product integration with Validin. See how @packetwatch helps protect their customers with Validin in our latest case study:
validin.com/blog/packetwatch…
Validin retweeted
We have improved our Oracle E-Business Suite fingerprinting by adding domain based scans in collaboration with @ValidinLLC. Around 950 exposed instances now seen globally (no vulnerability assessment). CVE-2026-46817 attempts have been observed in the wild by @DefusedCyber
With the World Cup in full swing, we dug into the IoCs from @GroupIB's Ghost Stadium report and found 3,079 domains still active in the past 14 days.
We've published the full list of 6,000+ suspected domains publicly. Full write-up below ⤵️
validin.com/blog/ghost_stadi…
Read their report, with more technical breakdown of the mechanics of the campaign, here:
xitter.cf/GroupIB/status/2059531…
Validin retweeted
1/
Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom"
domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun
@astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
Validin retweeted
Lets use this pivot point on @ValidinLLC
Title: Zoom Client Update
Reported to @abuse_ch
Telegram info
'bot_url' "6366434554:AAFV0fUvPM4BdKKUvMt9aQwg1nQ8MsxCpXE"
'chat_id' "588250349"
⚠️Observed phishing URLs delivering RMM payload:
Theme: Zoom
RMM: ScreenConnect
URL: hxxp://zoom.web-interviews[.]live
VBS Download URL: hxxps://zoom.web-interviews.live/download.php
SHA256:65208b731a5a0956a90d8cd415825123029712acdf240ab6d613154c4307c087
#ThreatIntel #Phishing #RMM
Validin retweeted
Validin's threat intelligence platform requires unfettered access to data, with affordable, high-performance storage, bandwidth, and scaling.
They’ve found that with Vultr Bare Metal, Cloud Compute, and File System.
See how @ValidinLLC wins with Vultr: blogs.vultr.com/validin-case…
Six months after @DJSnM and @_JohnHammond were targeted with a fake "DMCA takedown" campaign, we revisit old pivots and find some new connections.
validin.com/blog/dmca_phishi…
Validin retweeted
#PIVOTcon26 edition is over! Time to #pivot to #PIVOTcon27
Big thanks to our sponsors for making this happen!
@silentpush @vtxproject @censysio @urlscanio @ValidinLLC @TalosSecurity @abuse_ch @SpamhausTech @ecrime_ch @epieos @sekoia_io @wearetlpblack @webscout_io @rationaledge 1/
