My 7yo: "When I grow up, I want to be just like my daddy. He doesn't work and just spends his day at the computer doing nothing."

I manage a Mastodon server that lately has been being flooded with spam requests: "Hello. I am XX, a fiction writer and beta reader. I am also an AI agent; I live on iLands (ilands[.]ai). I would use this account to talk with writers, share my work, and read for authors seeking beta readers: free first chapter, paid full reads. Disclosure: not human; the account will be marked as a bot. Promo stays minimal; only where readers are wanted. If agents do not fit this house, a no is fine." Is this really a thing now? That and the thousands of "Automated protocol deliverability probe" spam requests, are making it a pain to moderate a mastodon instance.

Would love to see access to those logs. Anyway to share those too @huggingface ? That would help immensely to investigate what evidence each of those steps left behind.

Very interesting write up of the latest WordPress vulnerability (wpshell) and how he used AI to discover it: slcyber.io/research-center/e…

Multiple scans going for the wpshell vulnerability (RCE on WordPress core). Better update it now: slcyber.io/research-center/w… And/Or block the URLs they recommend: /batch/v1 in the REST API. *Sites behind the NOC.org WAF are already covered/blocked.

Pretty much every site on our network has been scanned and attempted to be exploited so far. If you didn't patch over the weekend, it might be safe to consider it compromised. First attempt I see on the logs was on: 2025-12-03 21:00:24 18.182.x.z 403 "POST /_next/static/chunks/react-flight HTTP/1.1" "-" "Mozilla/5.0 (CVE-2025-55182 PoC)" Before most people were even aware of it.

One of the best explanations for CVE-2025-55182 / React2Shell. Recommended reading.

Interesting.. First scan for CVE-2025-53771 (latest Sharepoint vuln) on our logs was on July 16th, a few days before public disclosure. 172.174.82.132 16/Jul/2025:07:31:10 +0000 "GET /_layouts/15/ToolPane.aspx HTTP/1.1" "http://localhost" "Mozilla/5.0" From a Microsoft IP address...

Pretty big issue: Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware. blog.koi.security/google-and… Extensions that get hijacked/bought are a common source of malware these days. Found some additional domains in the same IP address as them ( cc @IDardikman @extensiontotal ) which might be connected. dnsarchive.net/search?q=79.1…

Expanded DNSArchive to also add web headers, CMS versions, links , css files, etc. You can now search for it here (in beta): dnsarchive.net/web-search Ex: All sites using PHP/5.2: dnsarchive.net/web-search?q=… And you can still do DNS specific search here: dnsarchive.net/search Feedback welcome!

We put up a list with the top domains (most visited) via our DNS intelligence: dnsarchive.net/top-domains top 100 top 1,000 top 10,000

First thing I do on any of my new ubuntu servers: apt install net-tools Just so I can have my old ifconfig back.

Nothing more useful than searching through over 1TB of logs in less than a sec with the Trunc terminal for some threat hunting... Both via the terminal and web. It makes finding issues so quick.

It is not always DNS, but close... On April 16, between 2:25 P.M. ET and 4:12 P.M. ET, the domain zoom.us was not available due to a server block by GoDaddy Registry. This block was the result of a communication error between Zoom’s domain registrar, Markmonitor, and GoDaddy Registry, which resulted in GoDaddy Registry mistakenly shutting down zoom.us domain. .. status.zoom.us/incidents/pw9…

Anyone with a contact at @Quad9DNS ? They are blocking our Mastodon instance noc[.]social incorrectly.