Quantitative Security spent 31 July through 9 October 2026 on the public series the mid-year review had built the tooling to produce. The series runs from the cloud-range reconnaissance of 31 July to the unpaid Coinbase-card lure of 9 October, delivered as TLP:CLEAR long-form on X. August turned the method inward: a GitHub neighbor resolved to a health-plan sales identity, the company’s own domain was measured as an external target, and a year of carrier labels was settled against the registry. September took the same reduction to a residential firewall and to one snowshoe mill, and kept the platforms those cases sat on in their own class. October separated a discard log into measurement, known hostile nets, and the company’s own tools, set a wider claim about Yandex Compute against the vendor’s documents, and followed a card kit through to an invoice that stayed unpaid.
Each product moves raw telemetry and open sources to an attributed, prioritized, defensive-ready result. A name attaches only where the piece attaches it. The platform, the tenant, the survey project, and a signature that passes each keep the class the piece gave them. The closing position lists the methods used, the methods mapped, and the group, tenant, or class that sits on each.
The Report Series
Residual Cloud Surface — 31 July
A structured external pass across about 115 addresses sorted live production, residual services, and abandoned assets. Turkish shared hosting at 104.247.165.210 (silaoglu.com, bannered mt-rohan.guzelhosting.com) presented a complete mail and web stack: Pure-FTPd, Dovecot, Exim, MySQL, and LiteSpeed, with authenticated SOCKS5 and HTTP proxies and short-lived certificates beside it. The largest volume sat in Tencent and Aceville space and was tightly filtered. The minority that answered was the residual surface: Nginx Proxy Manager on port 81, a live Next.js application under /arena, authenticated proxies on high ports, Windows Remote Desktop with internal-style hostnames, and leftover certificates for a GENIEX eSIM brand and for Indonesian and Vietnamese game brands, including a Dragon Raja title still served by aging Jetty. A small Laos-linked set on one Tencent address presented Chinese-language medical-aesthetics and used-car sites with a thin public footprint. The product is the same separation the mid-year review applied to Google’s edge. Production volume and abandoned services are different findings, and only the second is a block and hardening problem. https://x.com/i/article/2083245764969635841
Protective-Intelligence Engagement — 1 August
The engagement opened when a masked address geolocated to Iran visited Quantitative Security infrastructure. Social engineering of that interaction trapped a set of addresses, expanded through a purpose-built site that harvested visitor infrastructure. The published baseline names GoCodeIT Inc. of Thornhill, Ontario, on authenticated proxies at 65.111.5.29 and 74.119.149.79; an exposed CloudPanel 2.5.2 at 103.255.134.61 for technofaq.org; a Microsoft-style CodePushServer at 152.32.169.33 on port 8888; rejekibet.com as an Indonesian real-money gambling platform with scam clones around the brand; internet-facing Windows Remote Desktop, including 38.107.237.68; geniex.com as a Nigerian virtual-SIM operation in wind-down, the domain itself resolving to AWS; and acmmanufacturer.com, previously on residual Tencent space and later moved to Zenlayer through chukouplus.com. Proxy hosts in 104.207.0.0/16 required authentication, presented certificates of about seven days, and returned 404 on the probed admin paths. Zeus-admin listeners stayed filtered. A geolocation label on the opening address is the start of the engagement. The article assigns no named state group. The dataset was closed as a baseline for the second half of the year. https://x.com/i/article/2083388096285179904
GitHub Load Balancer to a Brazilian Health-Plan Sales Farm — 8 August
A 7 August hotspot session with QuantumGuard and a capture began from a GitHub pull request and reverse-IP of Seattle load balancer 140.82.116.3 (lb-140-82-116-3-sea.github.com). That address co-hosted coindream.site: web on GitHub, mail SPF pointed at UltaHost cp5 159.100.6.5, created 23 January 2026, privacy registrant, Namecheap DNS. The capture contained no packets to the later case addresses. UltaHost held on the order of 500 names, including shelleasternpetroleum.ae registered to Christian von Langermann, plus gamingcomission.co, antifraud.click, aranttru.com, and pinupcasinorussia.click. Web ports later filtered to cPanel on 2082 and 2083. pro114.dnspro.com.br at 187.33.241.58 exposed a full mail and panel stack and public MariaDB 10.11.18.
The primary node is shared.qloudhost.com at 45.87.42.74, a 2017–2025 Brazilian health-plan sales farm using the brand names Bradesco, Amil, Unimed, and SulAmérica. WHOIS on the core portfolio is Fabiola Silva Souza, handle FASSO283, mailbox at saudeperfeita.com.br. Public records in the article match CNPJ 40.950.276/0001-55, Fabiola Silva Souza Seguros Ltda, Mococa, São Paulo, opened 23 February 2021. The bridge site saudeperfeita.com.br is HostGator at 162.241.2.92, with WordPress users admin and nildo, tied in the article to Roger Oliveira da Silva of Agência Unit and to Leonildo Quintiliano. Tiago Ferreira Pena is an adjacent registrant on the same nameservers. The same node also held fake-bank pages, casino registration, and Paysafe and Neosurf converters. QloudHost markets casino hosting. Shared nameservers and the saudeperfeita mailbox link the health-plan operators. Co-tenancy on the node does not extend that identity to the financial or gambling tenants. vendasbradescosaude.com.br remained on the qloud address after OpenDNS, Cloudflare, and DNS4EU had classified it as phishing. Left open in the piece: the full registro.br portfolio, the original pull-request URL, and secondary pivots on von Langermann. https://x.com/i/article/2085939414463631360
Own Domain as an External Target — 15 August
From 9 to 14 August, quantitativesecurity.org was examined with the same opening moves an outside hunter would use. The origin was clean. Hosting is Squarespace multi-tenant anycast, with NS1’s p07 set plus Squarespace DNS, Let’s Encrypt on the customer names, and a 403 from the bare addresses carrying a DigiCert certificate for *.squarespace.com. nmap reported a Go net/http implementation while the Server header said Squarespace. That pair is one edge described at two layers. About 1,900 .academy names share the platform. Gophish-class indicators were tested and absent. QuantC and QuantumGuard recorded the self-recon as platform noise, which is the ground truth those sensors need. The material residual risk is identity: no MX, no SPF, no DMARC, and a registration approaching a September 2026 expiry. A clean origin whose mail lane is unsigned is still an attack surface. https://x.com/i/article/2088437251508436992
Capability Levels — 15 August
A companion essay separates criminal crews from nation-backed actors by tactics and by cumulative dollars, and reserves a third category for exposure work that takes nothing. At the low end the essay’s mapped example is a caller known as Man hands, also called Tiffany M.: hardware-wallet and exchange-support impersonation, at least $5 million, Trezor and Coinbase, spoofed BitcoinIRA mail, panels supplied by associates, weak operational security. That figure is the essay’s theft total for that caller. Mid-level examples in the same piece are Dritan Kapllani Jr. at about $19 million, and John Daghita, called Lick, at more than $46 million from U.S. Marshals Service seized wallets, with the essay’s broader suspected activity above $90 million, later arrested. The higher criminal example is the Greavys, Wiz, and Box crew, about $243 million from a single Genesis creditor. Nation-backed examples are Lazarus and the February 2025 Bybit theft of about $1.5 billion; UAC-0145, linked in the essay to Sandworm / APT44, using fake job interviews against Ukrainian IT professionals and a VPN configuration as the delivery; and Laundry Bear, described as Russian-linked use of compromised credentials against government, defense, and critical infrastructure. https://x.com/i/article/2088672299868377088
The .academy Neighborhood — 17 August
Reverse-IP of the Squarespace connect quartet compiled 2,020 neighbor names. 1,898 ended in .academy, and 1,767 of those still resolved only to 198.49.23.144, 198.49.23.145, 198.185.159.144, and 198.185.159.145, AS53831. Fifty-four unique addresses appeared in the whole set. Forty of forty sampled Squarespace names returned the Squarespace header and a crumb cookie. Abuse reports and historical offline malware URLs on 198.49.23.145, including Cobalt Strike and Mozi paths, attach in the article to other tenants on the shared edge. The property line is the brand name and the four official connect addresses. School names stay off the block list. Reputation that keys on the address rather than the hostname is a platform cost, and it is documented as that. https://x.com/i/article/2089015652753502208
The Identity Layer — 17 August
The same domain’s registrar family, dual nameservers, and four anycast addresses are the legitimate baseline, and they are the surface an imitator copies. Squarespace, Cloudflare, Vercel, GitHub Pages, and AWS Global Accelerator already carry the reputation, the headers, and the certificate authorities. A foreign Host still fails closed, so a simple address block is noisy. The levers the article names sit at the registrar: a transfer, a nameserver change, contact hygiene, and an aged registration, then either a lookalike name or an arbitrary name parked on the trusted edge. Twelve of twenty-seven outlier .academy apexes in the companion count were registered at Squarespace Domains and hosted somewhere else. The controls that match the layer being manipulated are registrar lock, platform multi-factor authentication, Certificate Transparency on lookalike names, and a hard-fail SPF record where the domain sends no mail. https://x.com/i/article/2089012676634738688
A Verizon Allocation Recorded as T-Mobile — 23 August
On 5 August an own report labeled client prefix 2600:1010:b204:: as T-Mobile-style. The handset has only ever been Verizon, original owner. ARIN shows NetName WIRELESSDATANETWORK, organization Verizon Business (MCICS), registered 6 April 2010, covering 2600:1000:: through 2600:1017:ffff::. Soft asname and geolocation feeds carried the T-Mobile label from October 2025 through the day of that report. A live pull on 21 August returned Team Cymru AS6167 CELLCO-PART and RIPE AS22394 CELLCO. The allocation had not moved. The working order published with the piece is the order for the rest of this series: attribute the tool, then the tenant, then the registry. https://x.com/i/article/2091560316878671872
A 2023 Inventory, Ranked — 23 August
Two hundred ninety-four screenshots from a Charter residential path in New York in early 2023 were carried forward as a ranked set: about 1,450 IPv4 addresses, about 1,266 of them public, on an explicit T1-through-T5 scale. The 2026 pass closed services before it left anything open. 103.235.46.191 is Baidu’s Hong Kong analytics edge, hm.baidu.com, AS55967. 23.82.31.230 is TradingView on Leaseweb. A Boeing-range address was placed on a document-only list. Later public reporting of a LockBit intrusion against Boeing’s parts business shares an organizational name with that documentary row and shares no session. Charter’s February 2023 voice outage, the July 2023 Storm-0558 statements, later Salt Typhoon reporting, and Leaseweb’s own notice of 22 August 2023 are context windows. https://x.com/i/article/2091569041584619520
GitHub on Fastly — 27 August
QS-NetHarden ran on a phone tether. Capture start was 09:08 PDT on 26 August. NetCloak presented a new Windows identity. Artillery decoys were up with the ban off. Phantom-QS cycled Firefox 128. Nothing in the honeypot log that morning is a remote hit. The DNS is the operator: the chat proxy, GitHub’s load balancer, Actions, Copilot, then release-assets.githubusercontent.com. The covering prefix 185.199.108.0/22 is RIPE US-GITHUB-20170413, organization GitHub, BGP origin AS54113 Fastly. Fastly’s own published address list does not include it. The .133 set is the content catch-all. The .154 set is releases and packages. The Actions front door is Microsoft 13.107.42.0/24 and 13.107.43.0/24, and pipelines.actions resolved to 13.107.43.16 in that pass. URLhaus carries malware URLs on the release-assets name, and Harden-Runner has flagged it. The hostname is the truck. The actor is the cargo and the next hop that is not GitHub. Block the follow-on virtual server. Leave the leaf, the Fastly catch-all, Azure Front Door, the regional snapshots, and the sensor alone. https://x.com/i/article/2093021792923508736
One Snowshoe Lead Mill — 29 August, continued 7 September
On 27 August a single inbox took 72 unsolicited auto-insurance and credit-card messages, 156 unique links, 71 From domains. Subject clustering produced three duplicate pairs. The invariant is the token e6jbv4z in every body and every link. Clicks use a two-letter label on an aged apex and a PHP path of the form /r plus hex digits. Policy Plug accounts for 51 of the 72. Easy Insurance Match, Endurance, and Indigo and Destiny Mastercard are costumes. A large subset copies LendingTree’s NMLS number 1136 and a Charlotte street address. LendingTree is the footer-theft victim. Mail and clicks sit on NForce, AS43350, in 185.47.200.0/24 and 185.47.203.0/24: nginx, PHP 7.4.33, 443 closed, 25 filtered. The domains are aged Name.com inventory. A HEAD request receives a generic nginx 403. A browser-like GET receives a 302 toward a CAKE lander, offer a=44 and c=2701, on taobmaets.com, or an unsubscribe page on keycanvascanvas.com. Attachments named as Office files are plaintext. ClamAV was clean. One Host header, mediaignorance.com, returned the same 52,667-byte body from seven addresses in the /24. Unredacted WHOIS on four apexes names Robert Carpino, treated in the articles as a pivot. The buyer behind the CAKE offer is unidentified. On 7 September a further harvest of the same token and the same path shape, auto-insurance and Indigo costumes, was published as already present in AT&T’s database. The post asserts one shared nameserver set and does not print it. Defender action is the token, the path, and the two NForce prefixes, reported to [email protected] and to the registrar, with the stolen NMLS line identified as theft of a footer. https://x.com/i/article/2093528643779825664 https://x.com/i/article/2093532720119083008 https://x.com/i/article/2097103637160022017
Residential Firewall, First Pass — 5 September
An AT&T residential gateway log held 296 events across 26 minutes, 188 unique addresses, 169 of them public. The slice is the background radiation of a public IPv4. Cards from 31 August had already named QNAX, Recyber, Infrawatch, Xpanse, Censys, Pfcloud, and CHINANET. Three findings were new. QNAX 45.140.193.187 hit the WAN ten times in 21 minutes. The article cites 408 AbuseIPDB reports from 170 sources, all hostile, and a VNC brute force on tcp/5900 using RFB 003.008. qnax.sh sells that VPS, RDP, and console-VNC product. The first named inbound inside a Spamhaus DROP net was Pfcloud 176.65.149.233, in 176.65.148.0/22, at 11:58. n8n.pfcloud.io sits on 176.65.148.168. sso.pfcloud.io identifies itself as authentik. The Tamatiya and 4vendeta spray across 79.124.58.0/24, 79.124.49.0/24, and 78.128.114.0/24 includes 79.124.58.90, whose reverse name is ip-58-90.superbit.host and whose alias is urlforward.topdns.com, the same DigitalOcean address as ns-usa.topdns.com at 143.198.68.197. A passive expansion of topdns.com returned 517 labels, many of them brand collisions, almost all without addresses. The nameserver stays unblocked. Priority hosts are 45.140.193.187, 79.124.58.18, 79.124.58.90, 79.124.49.90, 78.128.114.46, and 78.128.114.162. Optional nets are the Tamatiya customer and operations slices and Pfcloud 176.65.148.0/22 plus 204.76.203.0/24. Left alone with them: TopDNS, CriminalIP collectors, Cloudflare edges, census scanners, and Telepoint 78.128.42.0/24. Abuse contacts published with the piece are [email protected] and [email protected]. The sensor was on a hotspot. The LAN was not scanned. The piece sits on the 24 July Tamatiya note from the first-half series. A 4 September website pointer carries the series title and points at the company site; the X record of the measurement is this article and the next. https://x.com/i/article/2096029788624523264
Residential Firewall, Remainder — 6 September
The 29 August and 5 September windows together produced 530 unique events and 270 inbound public addresses. This second piece is the leftover 105, after census scanners and the named commercial lookers had been set aside. Seventy-four of 108 checked addresses appeared in a public feed that day. None appeared in Feodo, SSLBL, ThreatFox, or Emerging Threats. Twenty-one sat in Spamhaus DROP prefixes dated 4 September, including the Pfcloud /22. The article cites a 25 June account of UniFi OS exploitation launched from 176.65.148.183 in that prefix, and CISA’s 23 June addition of CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. Ghosty 43.228.157.0/24 and Stormcloud 94.154.43.0/24 are Mirai neighborhoods on URLhaus in the same piece. The loudest remaining inbound address was still QNAX 45.140.193.187, with the article’s count at 412 reports, last seen 1 September on port 5000. 46.146.238.1 is an exact URLhaus host for a high-port dropper, with telnet open. UniFi OS on 195.252.206.160 had no address-feed hit and is a service-class match to SAB-067, CVE-2026-77550, dated 26 August. EMBNEX 16.5.0.0/24 is eight dump origins; the website embnex.com is CloudFront. An identical short HTML blob on unrelated nets is a sink page. The recommendation is to block the nets. https://x.com/i/article/2096732079388299264
Hotspot Egress to a Management Node — 14 September
Traffic from a personal device on an iPhone hotspot reached 113.176.118.150, named static.vnpt.vn and rdp.cdmt.vn. The address presents MikroTik RouterOS 6.49.13, Nginx Proxy Manager on port 80, name-gated HTTPS on 443, a public MeshCentral login on 5009, a public UniFi login on 8443, two SSH daemons on 8080 and 8090, and an unidentified CONNECT-style service on 8088 that involved the CloudFront name d3azdm1q0gvo54.cloudfront.net. The published hypothesis is an internet-facing gateway and management node. Egress toward it from a personal hotspot stays unauthorized until it maps to a known application, user, or device. https://x.com/i/article/2099540826854715392
A Thin Waitlist — 22 September
uythjmnglk.xyz was registered at Dynadot on 14 September 2026, privacy-proxied, on the Cloudflare nameserver pair phoenix and wilson, with no DNSSEC. Only the apex and www answer. Off the local network the application was a waitlist titled “You’re on the list,” posting an email to a subscription path under token v:897qvxac7fny03ac. On the AT&T gateway the same name returned a short interstitial whose reason was malware. That page is the carrier, not the origin. The two Cloudflare addresses in front of the name appear in a June 2023 Mystic Stealer appendix. They are shared anycast, and three years sit between that appendix and this registration. Same-day casino and 4D names at the same registrar use a different nameserver pair. An older pair hosts the “A little chicken” lander tied to a FanPartners affiliate path. Those clusters stay off this seed. The Cloudflare addresses stay off any campaign block list. https://x.com/i/article/2101850617815908352
CAC and DEERS Notices — 28 September
Two notices reached a personal Gmail from [email protected], on 9 March 2026 and on 7 May 2026. The May message passed SPF, DKIM, and DMARC. DKIM was d=mail.mil, selector EEMSG2021v1a, policy reject. The message identifier names UHIL19PA53.eemsg.mail.mil at 214.24.21.199. The S/MIME signer is [email protected], issued by DOD SW CA-83, valid from 15 October 2025 through 15 October 2028. Gmail’s banner is that the From and the signer differ. The two mailboxes are different, and that difference is enough to produce the banner. The bodies say two identity documents are missing and tell the recipient to visit RAPIDS to upload them, on a 120-day clock in March and a 60-day clock, by 6 July, in May. No documents were submitted. The card kept working.
The official program the article cites began with DMDC notices in January 2026. By August about 215,000 active and reserve members were out of compliance. The Army had reviewed about 111,000 cards, with none revoked as of 2 September. About 21,500 Marines were still short in July. A 3 September official line, published 8 September, describes an administrative record update, with no fraud and no breach claimed for the missing documents. MARADMIN 393/26 requires two original documents, in person. The March body said upload.
The class the article keeps in the vocabulary column is a body introduced at or before the signer, so the checks still pass. A rewrite after Gmail’s verification is out, because DKIM passed. No original message file and no signature part were in hand. The mail host is AS345, 214.24.21.0/24, a Defense Network Information Center block from 1998. www.cac.mil is a name on Akamai, addresses 23.62.46.164 and 23.62.46.182, answering 403, and the certificate on that edge carries www.cac.mil together with a pentagon, defense, and department set of names. The DMDC applications idco, myaccess, and pki resolve in AS27064 on different 214 addresses, including pki.dmdc.osd.mil at 214.16.194.24. Nothing is shared between the mail prefix and those application prefixes. One geolocation product places the 214 queries in Columbus, Ohio. Another places them in Rose Hill, Virginia. It is one allocation.
Three adjacent records stay in their own lanes. A marketing page on email.usfhp.net from 20 July is a real US Family Health Plan property with ordinary HubSpot-class measurement. A file-share letter dated 18 September describes unencrypted access from October 2025 through 16 July 2026, discovered 16 July, and the article leaves it unjoined to this From line. An IDScan notice of 4 September concerns customer cloud accounts. Counts of about four million and of 60 million records are rejected in the article as victim totals. https://x.com/i/article/2104388574397554688
Seventeen Minutes of Discards — 3 October
A residential discard export printed from 05:55 to 06:12 on 3 October held 234 rows, 110 foreign addresses, and 166 hit-increments. Every row is a drop, and the export has no destination port. A later reading that shifts the window by about five hours is the same event on a different clock. Fifty-one of 57 scanner hits are named internet-wide survey projects: Infrawatch, Cortex Xpanse, Censys, Shadowserver, Stretchoid, Nokia Deepfield, and their neighbors. Ten exact addresses repeat from August, including 4vendeta 79.124.49.90, SS-Net 80.94.95.226, Ghosty 43.228.157.10, and Amarutu 89.42.231.200. QNAX and Recyber are absent from this window. New members of known nets include Pfcloud 204.76.203.4 and Stormcloud 94.154.43.203. Malware names on the Stormcloud /24 sit on sibling addresses. The address that touched the log is the discard, and the family name stays on the sibling where it was actually filed.
Eight UDP policy drops are the tail of a 20 September proxy-list check, packets the monitored network sent. Two Amazon invalid-packet rows carry no threat-list hits. A separate tether enrichment the same morning is ordinary carrier and content path: Verizon, Comcast, Lumen, Cogent, Google, and Cloudflare. The session that does not explain itself is 87.250.250.108, named cloud.yandex.ru. The only Spamhaus DROP hit in the fresh list match is 140.222.19.75 and 140.222.19.77 inside 140.222.0.0/16, SBL693942, read as a hijack pattern on old NSFNET space and left off a host block list. Collapsing measurement projects, bulletproof scanners, and the operator’s own tools into one indicator list manufactures an incident. https://x.com/i/article/2106513298426597376
Yandex Compute, Against the Public Record — 4 October
An opening claim in circulation said the Russian state reads Yandex Cloud guests by combining key custody, hypervisor access, silent disk clones, a pinned core map, a custom storage daemon, and a lawful-intercept feed on the scheduler. The article sets that claim against Yandex’s own compute documents and against what was already on this host. Default disk encryption uses a platform key. A customer key still lives in Yandex’s key service, and disabling it is a kill switch. Guest memory is ordinary memory of the QEMU process, so the operator of the host is on the same side of the trust boundary as the running guest. There is no libvirt. Live migration, dedicated hosts, and a same-host switch of QEMU builds are published product behavior. A host-id pin disables live migration and is written through the compute API by a principal who can already update the instance. The guest interface does not carry that write. What the cited pages do not show is a lawful-intercept subscription to the hypervisor control socket, to scheduler choices, or to host-affinity rules, and they do not show the silent clone, the fixed core map, the custom daemon, or the tunneled path in the wider essay. Local reverse names containing yandex were inventoried. 45.87.42.74 remains the August qloudhost sales farm, a different name. 87.250.250.108, the unexplained session from the discard piece, was absent from that earlier table. Registration splits Yandex.Cloud LLC on the cloud objects from YANDEX LLC on the enterprise network. Completed API certificates are Yandex, Moscow, GlobalSign. One advertising name still has a dangling reverse pointer at 77.88.21.179. https://x.com/i/article/2106548730942152704
An Unpaid Coinbase-Card Lure — 9 October
Two Telegraph pages, telegra.ph/NCO-09-27 and graph.org/UIN-10-05, share one continue link. Both sit on 149.154.164.13. They were published 27 September and 5 October. The link is rss2.sayler.at/go/337413/z274x264 on 107.189.20.230, and it redirects to a Coinbase Card kit at 97ee1.ralind.at on 31.59.121.53. The kit’s own script names 22 steps, from the index through a fast-pay page. A 6 October original post states that count and prints the same 22 filenames. The pages show a balance of $39,437.16. The scripts were last modified 26 August 2026. Eleven fee codes are named. Only y2a4u234, the $58 interbank line, was followed, onto bitpays.at at 31.57.29.11, stream 4374w2. A synthetic submission at 03:45 GMT on 9 October returned a redirect to a BTCPay invoice, 6QTpVwNe9CynFTXZFJE8Yk, on btcpay369329.lndyn.com at 172.81.177.1. Status New. Fifty-eight dollars, 0.00070469 BTC, rate $82,306.45, address bc1qexqsudur4860kva5789qcvkmpdk4j9wrfrsmzy. The paid-check returned zero. No payment was sent.
ip-api places the kit in Paris and the payform in Riga. QuantumGuard and the origin registry place 31.57.29.0/24 in the United Arab Emirates, AS56971. sayler.at, ralind.at, and bitpays.at use DNSPod. The 6 October note, on the object that carries SOA serial 1789107920, places that object in Zaandam under AS14956, RouterHosting and FranTech. The 9 October article does not repeat that placement. Telegraph’s nameservers, GoDaddy’s nameservers for graph.org, and the DNSPod addresses are shared DNS. 144.31.93.214 is off this chain. The 15 August essay and this lure both use the word Coinbase. The essay’s example is a phone impersonation crew. This piece is a page, a tracker, a card kit, and an invoice that stayed unpaid. https://x.com/i/article/2108597864108871681
Closing Position
Two lists close the series. The first is the methods Quantitative Security used. The second is the methods the pieces mapped, each with the group, tenant, or class the piece put on it. Essay examples stay under the 15 August essay. Sibling tags stay on the sibling address. Survey projects stay in the measurement bucket. Where a piece names no group, the line ends at the tenant, the net, or the class.
Methods used
- Structured external passes over banners, certificates, and listening services, with abandoned assets separated from production volume.
- A visitor engagement opened by social engineering, then expanded by open-source enrichment. Reconnaissance only.
- Reverse-IP, WHOIS and registry pulls, mail-authentication records, and a packet capture checked against the addresses those records named.
- The company’s own domain, run through the same opening an outside hunter would use, with the self-recon kept as sensor noise.
- Soft geolocation and asname feeds checked against ARIN, RIPE, and Team Cymru. The order is tool, then tenant, then registry.
- A ranked historical inventory, closed to service identity before any public incident was joined to it.
- On-path DNS and honeypot logs, read so the company’s own sessions stay separate from remote hits.
- Mail reduced on an invariant token, a HEAD request set against a browser GET, and one shared virtual-host body hashed across the prefix.
- Residential discards reduced against AbuseIPDB, Spamhaus DROP, URLhaus, Feodo, SSLBL, ThreatFox, and Emerging Threats, with passive name expansion leaving the nameserver off the block list.
- Hotspot egress held as an association, and follow-up measurement timed apart from the first session.
- Registrar, nameserver pair, and carrier interstitial separated from origin content.
- SPF, DKIM, DMARC, and S/MIME read together, and held at a class when the signed original was not in hand.
- A discard export bucketed into survey projects, repeat hostile nets, the company’s own packets, and the session that did not explain itself.
- Vendor compute documents read against a wider claim, with the unsupported clauses left out of the finding.
- A lure chain followed through the tracker, the kit, one fee code, and a synthetic unpaid invoice. No payment was sent.
Methods mapped, and the name on each
- Residual cloud services and short-lived authenticated proxies. The residual brands are GENIEX, game titles including Dragon Raja, and a thin Laos-linked set of medical-aesthetics and used-car sites.
- Visitor-infrastructure harvest. The opening address was geolocated to Iran, and the article leaves the label there. The baseline names GoCodeIT Inc. of Thornhill, Ontario; rejekibet.com and the scam clones around that brand; and geniex.com in wind-down.
- Brand-name health-plan sales, and a site already classified as phishing, on shared hosting. The associated names are registrants. Fabiola Silva Souza and Fabiola Silva Souza Seguros Ltda hold the core portfolio. Roger Oliveira da Silva and Leonildo Quintiliano sit on the bridge site. Tiago Ferreira Pena is an adjacent registrant. Christian von Langermann is the registrant of shelleasternpetroleum.ae, a co-tenant. OpenDNS, Cloudflare, and DNS4EU classified vendasbradescosaude.com.br as phishing. The fake-bank, casino, and wallet-converter pages on the same node remain neighbors.
- Trusted-edge imitation: a lookalike or an arbitrary name parked on Squarespace, Cloudflare, Vercel, GitHub Pages, or AWS Global Accelerator. Historical Cobalt Strike and Mozi URLs on 198.49.23.145 are other tenants of that anycast.
- Capability tiers, in the 15 August essay. These names are the essay’s examples. Man hands, also called Tiffany M.: hardware-wallet and exchange-support impersonation, spoofed BitcoinIRA mail. Dritan Kapllani Jr. John Daghita, called Lick, against U.S. Marshals Service seized wallets. The Greavys, Wiz, and Box crew, against one Genesis creditor. Lazarus, the February 2025 Bybit theft. UAC-0145, linked in the essay to Sandworm / APT44: fake job interviews, with a VPN configuration as the delivery. Laundry Bear: Russian-linked credentials against government, defense, and critical infrastructure.
- Malware URLs carried on a GitHub release hostname whose BGP origin is Fastly. The mapped method is cargo on a trusted hostname. The block is the follow-on virtual server.
- Snowshoe lead generation. The costumes are Policy Plug, Easy Insurance Match, Endurance, and Indigo and Destiny Mastercard. LendingTree is the victim of a stolen NMLS footer. The mail and the clicks sit on NForce, AS43350. Unredacted WHOIS names Robert Carpino as a pivot. The buyer behind CAKE offer 2701 is unidentified.
Residential scanning and hostile hosting.
- QNAX. Sells VPS, RDP, and console VNC. The mapped method on 45.140.193.187 is RFB brute force on tcp/5900.
- Pfcloud. Inside a Spamhaus DROP prefix, with n8n and authentik named on that net. A 25 June account places UniFi OS exploitation at 176.65.148.183 in the same /22. CISA’s 23 June entries name CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, described in the piece as a Mirai-class loader.
- Tamatiya and 4vendeta. The spray across the customer and operations slices. TopDNS stays the forwarder. Recyber is on the August cards and is absent from the 3 October window.
- Ghosty 43.228.157.0/24 and Stormcloud 94.154.43.0/24. Mirai neighborhoods named on URLhaus. On the Stormcloud /24 the further tags, including ApexBot and LummaStealer, sit on sibling addresses. 94.154.43.203 is the address that touched the October log.
- Stealc, MooBot, Vidar, and XWorm. Named on other 193.233 hosts, on different autonomous systems from the scanner at 193.233.198.28.
- 46.146.238.1. An exact URLhaus host for a high-port dropper, with telnet open.
- UniFi OS on 195.252.206.160. A service-class match to SAB-067, CVE-2026-77550.
- EMBNEX. Eight dump origins. embnex.com is CloudFront.
- Survey projects in the same logs: Infrawatch, Cortex Xpanse, Censys, Shadowserver, Stretchoid, and Nokia Deepfield. Repeat net-names in that measurement set include SS-Net and Amarutu.
- Internet-facing management services on one address: MikroTik RouterOS, Nginx Proxy Manager, MeshCentral, and UniFi.
- A one-day waitlist on a privacy-proxied Dynadot name. The piece names no group. Mystic Stealer appears as a June 2023 appendix that listed the same Cloudflare anycast addresses. FanPartners and the “A little chicken” lander use a different nameserver pair.
- Mail that passes SPF, DKIM, and DMARC on a Defense Network Information Center host, with the From line and the S/MIME signer different. The program in the article is the DMDC identity-proof gap. The mapped class is a body introduced at or before the signer. The September file-share letter stays on its own dates.
- A wider claim about reading Yandex Cloud guests. The documents support a platform encryption key, a customer key that remains a kill switch inside Yandex’s own key service, and guest memory as ordinary memory of the QEMU process. 87.250.250.108, named cloud.yandex.ru, stays the session the discard piece could not explain.
- A multi-step card lure: two Telegraph pages, one tracker, a 22-step kit, a fee-code payform, and a BTCPay invoice left unpaid. The 15 August Coinbase example remains the essay’s phone-impersonation crew, Man hands. This piece is the page, the tracker, the kit, and the unpaid invoice.
