@tmctmt
tmctmt.com/posts/
Joined April 2026
  • Tweets53
  • Following74
  • Followers845
21Media
Pinned Tweet
tmctmt@tmctmtMay 15
Mullvad exit IPs are surprisingly identifying tmctmt.com/posts/mullvad-exi…

Mullvad exit IPs as a fingerprinting vector

Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the...

tmctmt.com
50
220
46
2,432
828,139
You can get an approximate edge-to-origin timing on most Cloudflare sites by subtracting the latency of /cdn-cgi/trace (hits edge only) from your normal requests' latency. If you have a bunch of proxies you can cycle between edges and get a good idea of the origin's geoloc
4
5
199
4,979
Demo: gist.github.com/tmctmt/3f1d2… It uses Mullvad proxies to cycle edges so you need to be connected to their VPN to use this.

Cloudflare origin geolocator

Cloudflare origin geolocator. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
17
511
I made a searchable pastebin archive since there weren't any left: pastes.zip
3
1
20
749
Fascinated by the Better Call Saul email bombing script
3
60
no promise this will stick around long-term, just testing the waters for now.
1
159
If you have Signal installed on a device you don't check often, it basically defeats the purpose of disappearing messages.
1
7
600
not sure if this applies to deleted messages or view-once media too
2
134
I was wondering why Chrome was refusing to use ECH on websites where it works just fine in Firefox. It turns out Chrome only enables ECH if your system DNS server supports DoH. If you use Mullvad, its internal DNS servers are plaintext only.
3
3
1
71
11,189
To clarify, the issue isn't a lack of encryption for DNS queries. The traffic is already encrypted at the tunnel layer and it stays in Mullvad's intranet. The real issue is that Chrome *thinks* it's insecure, which triggers it to turn off a privacy feature.
14
957
people in the replies have never stalked someone online and it shows😔
alpha@omarsbigsisterMay 30
Stop telling me to use duckduckgo IT SUCKS
1
3
1,349
I can confirm that Mullvad's new mitigation (currently available on select servers) indeed fixes the IP position correlation flaw.
Mullvad.net
@mullvadnetMay 20
On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users. We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks. Read more here: mullvad.net/blog/exit-ip-fin…

Exit IP fingerprinting between VPN servers | Mullvad VPN

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.

mullvad.net
3
44
559
57,954
The IPs are still assigned deterministically though and afaict they won't change until the pubkey rotates, which is a bit of a bummer.
12
1,955
Just released a tool for identifying domains under common ownership using Cloudflare nameserver pair correlation (with some historical data support!): tmctmt.github.io/cloudflare-…
2
3
4
1,069
For those unfamiliar with the technique, this post by Aidan Thomson describes it pretty well: interrupt.sh/blog/discoverin…

Discovering domains via NS correlation

A simple OSINT technique for discovering related domains.

interrupt.sh
2
2
528
I don't plan on keeping the database up to date, but since Cloudflare is already experimenting with randomly assigned nameservers, there may not be much point in doing so for much longer anyway.
353
A novel-ish means of finding Satoshi, including a website where you can test your own guesses. All bad writing is by me. Done in collaboration with @tmctmt. foxchapelresearch.substack.c… If you're interested in funding this, please lmk.
9
9
4
71
9,136
how it feels to say pwned as a gen z
Herman.fun
@doomscroll_xMay 9
The Millennial falloff will be studied for generations
8
705
neat trick with mediafire: you can reveal uploader names for single files using mediafire[.]com/api/1.5/file/get_info.php?quick_key=file_id_goes_here
8
70
2
1,155
56,774
tmctmt retweeted
Rafael
@beescoituMar 21
Totally forgot to post about this, but after researching, I had suspicion that some of the netflow data from tzulo.com (AS11878) was being fed into Team Cymru's platform. A bunch of VPN providers, including Mullvad (22% of their servers!), ivpn and Windscribe were Tzulo clients at the time. After trying direct contact with Tzulo and getting a not-so-helpful response, I decided to reach out to the VPNs. Out of all of them, surprisingly @windscribe was the only one that took a closer look at it. They escalated it to Tzulo, who confirmed the culprit was Sharktech, their upstream provider (also mentioned in my initial research). Tzulo has since migrated away from them, but this confirms netflow data from some of these servers was indeed being captured before September 2025 (when Windscribe sent me this email). Hopefully this has contributed a bit to the privacy community. Kudos to @windscribe for caring and to @404mediaco for inspiring this research :)
Rafael
@beescoitu18 May 2025
Spent pretty much the whole day compiling information on how and from where Team Cymru captures netflow data. I've published an initial version of all the resources I could find here (Includes a WIP version of ISPs that share data with them!): github.com/beescuit/netflow-…

GitHub - beescuit/netflow-data: Collection of publicly available resources related to the collect...

Collection of publicly available resources related to the collection, sale, and implications of netflow data. - beescuit/netflow-data

github.com
2
7
2
55
15,362
The worst part about the YellowKey exploit is the sheer number of misinformed people who are unknowingly going to bottleneck their SSD speeds by like 80% after switching to VeraCrypt instead of simply using password-based BitLocker github.com/veracrypt/VeraCry… reddit.com/r/VeraCrypt/comme…
Lain on the Blockchain
@CryptoCyberiaMay 17
After this Bitlocker backd- I mean exploit, Veracrypt schizos should be incredibly smug. A lot has been said on FOSS vs. closed source with regards to security, but for something as solved as OS encryption, FOSS makes most sense, by a lot.
5
1
1
59
10,411
Load more