Zach Edwards
@thezedwards.bsky.social
data supply auditor | privacy & ad tech expert | internet threats
Personal @ victorymedium.com
Sr Threat Analyst @ SilentPush.com
Personal @ victorymedium.com
Sr Threat Analyst @ SilentPush.com
Today our team at @silentpush.bsky.social released research we’ve been working on all year – a magnum opus 39-page report on the state of Bulletproof Hosting Providers.
Brief thread with some details
Read the report @ www.silentpush.com/white-papers...
Brief thread with some details
Read the report @ www.silentpush.com/white-papers...
December 15, 2025 at 7:31 PM
Today our team at @silentpush.bsky.social released research we’ve been working on all year – a magnum opus 39-page report on the state of Bulletproof Hosting Providers.
Brief thread with some details
Read the report @ www.silentpush.com/white-papers...
Brief thread with some details
Read the report @ www.silentpush.com/white-papers...
Found a "great deal" in about 30 seconds of hunting -- 1k abuse reports on YouTube for $100 - a mere 10 cents per report! This is the type of bot farm product that shit birds use when they want to harass researchers and other folks.
December 13, 2025 at 6:17 PM
Found a "great deal" in about 30 seconds of hunting -- 1k abuse reports on YouTube for $100 - a mere 10 cents per report! This is the type of bot farm product that shit birds use when they want to harass researchers and other folks.
YouTube suspended my ~15+ year old account and all my videos due to a video I recorded about scammers targeting US government and military offices, which was embedded into articles like @ www.vice.com/en/article/w... from @josephcox.bsky.social
I was likely targeted by a mass reporting campaign.🤡
I was likely targeted by a mass reporting campaign.🤡
December 12, 2025 at 4:18 PM
YouTube suspended my ~15+ year old account and all my videos due to a video I recorded about scammers targeting US government and military offices, which was embedded into articles like @ www.vice.com/en/article/w... from @josephcox.bsky.social
I was likely targeted by a mass reporting campaign.🤡
I was likely targeted by a mass reporting campaign.🤡
a 5+ year old bug ticket was finally closed by Google - this was actually the last significant investigation into Chrome extensions that I did because the feedback loop was so challenging
definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖
definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖
November 19, 2025 at 3:47 PM
a 5+ year old bug ticket was finally closed by Google - this was actually the last significant investigation into Chrome extensions that I did because the feedback loop was so challenging
definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖
definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖
fun to see my mom in this crowd shot from the No Kings rally in Houston featured by the Houston Chronicle @ www.houstonchronicle.com/projects/202...
October 19, 2025 at 4:40 AM
fun to see my mom in this crowd shot from the No Kings rally in Houston featured by the Houston Chronicle @ www.houstonchronicle.com/projects/202...
I’ve got this 100+ year old copy of an old play about Abraham Lincoln’s life which was owned by someone named Alden Nash who had an interesting personal emblem that he screen printed & glued onto the cover page.
The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚
The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚
September 9, 2025 at 2:46 AM
I’ve got this 100+ year old copy of an old play about Abraham Lincoln’s life which was owned by someone named Alden Nash who had an interesting personal emblem that he screen printed & glued onto the cover page.
The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚
The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚
Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ www.silentpush.com/blog/socghol... 🖖🏻
August 6, 2025 at 7:49 PM
Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ www.silentpush.com/blog/socghol... 🖖🏻
This AI Agent from Cluep[.]com claims to scrape data from: Twitter, Youtube, Linkedin, Pinterest, Reddit, Tumblr and TikTok
They claim that they are scraping these networks then using "APIs" to further scrape "the user’s geographic coordinates, device type and demographic data"
how? WTF?
They claim that they are scraping these networks then using "APIs" to further scrape "the user’s geographic coordinates, device type and demographic data"
how? WTF?
May 21, 2025 at 4:24 PM
This AI Agent from Cluep[.]com claims to scrape data from: Twitter, Youtube, Linkedin, Pinterest, Reddit, Tumblr and TikTok
They claim that they are scraping these networks then using "APIs" to further scrape "the user’s geographic coordinates, device type and demographic data"
how? WTF?
They claim that they are scraping these networks then using "APIs" to further scrape "the user’s geographic coordinates, device type and demographic data"
how? WTF?
21 year-old money launderer for a $265 million crypto theft ring was helping members exchange crypto for cash and mailing $25k in cash through the mail put inside "Squishmallow" stuffed animals www.cnbc.com/amp/2025/05/... 🫧🐰
May 17, 2025 at 5:29 AM
21 year-old money launderer for a $265 million crypto theft ring was helping members exchange crypto for cash and mailing $25k in cash through the mail put inside "Squishmallow" stuffed animals www.cnbc.com/amp/2025/05/... 🫧🐰
It was an honor and a pleasure to speak at Bsides SF - totally love that they had an artist draw my presentation ⬇️
April 27, 2025 at 11:58 PM
It was an honor and a pleasure to speak at Bsides SF - totally love that they had an artist draw my presentation ⬇️
...and the “solution” is an easy “click fix” copy and paste trick, which leads to malware if the unsuspecting developer completes the process.
April 24, 2025 at 7:44 PM
...and the “solution” is an easy “click fix” copy and paste trick, which leads to malware if the unsuspecting developer completes the process.
cheers ya it's an interesting definition. i played w/ Gemini awhile ago and confirmed it still doesn't give you lists of URls but if you click the "Retry with Google Search" it does..
any ruling broadly covering this search concept could impact Gemini - would also impact Programmable Search Engine
any ruling broadly covering this search concept could impact Gemini - would also impact Programmable Search Engine
March 11, 2025 at 9:11 PM
cheers ya it's an interesting definition. i played w/ Gemini awhile ago and confirmed it still doesn't give you lists of URls but if you click the "Retry with Google Search" it does..
any ruling broadly covering this search concept could impact Gemini - would also impact Programmable Search Engine
any ruling broadly covering this search concept could impact Gemini - would also impact Programmable Search Engine
The singular organization who has prevented WWIII for decades is being attacked by this administration. We're losing allies, losing trade deals and becoming less safe due to how these folks see Russia as allies and all our traditional allies as enemies. This is completely backwards global diplomacy.
March 2, 2025 at 4:38 PM
The singular organization who has prevented WWIII for decades is being attacked by this administration. We're losing allies, losing trade deals and becoming less safe due to how these folks see Russia as allies and all our traditional allies as enemies. This is completely backwards global diplomacy.
I had to triple check this was accurate, that the President of the United States is endorsing three garbage crypto tokens tied to countless scandals, and likely untold numbers of investors got a heads up and made bank off the announcement. In the end, this will lose people money & hurt our country.
March 2, 2025 at 4:30 PM
I had to triple check this was accurate, that the President of the United States is endorsing three garbage crypto tokens tied to countless scandals, and likely untold numbers of investors got a heads up and made bank off the announcement. In the end, this will lose people money & hurt our country.
X specifically setup bot defenses so that viewing tweets requires having an account. You can see in this video if you open a tweet in an incognito / non-logged-in state, then click "replies" you immediately are prompted w/ a login, then blocked from reading more.
February 1, 2025 at 7:29 PM
X specifically setup bot defenses so that viewing tweets requires having an account. You can see in this video if you open a tweet in an incognito / non-logged-in state, then click "replies" you immediately are prompted w/ a login, then blocked from reading more.
The top downloaded / viewed PDF across the .gov ecosystem yesterday was for the OPM forking memo @ www.opm.gov/media/cbklse... according to analytics.usa.gov
January 31, 2025 at 2:22 AM
The top downloaded / viewed PDF across the .gov ecosystem yesterday was for the OPM forking memo @ www.opm.gov/media/cbklse... according to analytics.usa.gov
... to connect up their criminal client websites through a series of CNAME records they control, which are then mapped to hundreds of IP addresses that are hosted at a variety of providers.
You can see this DNS data flow via the chart attached:
You can see this DNS data flow via the chart attached:
![Screenshot of a mind map. On the left is the detail "FUNNULL customer hostname" connected by "CNAME" to 6 domains that look like fn01[.]vip and funnull[.]vip with slight variations on numbers on the other 4. This chain is connected by another "CNAME" line into 3 additional CNAME records, for fn301[.]vip + fnvip100[.]com + funnull10[.]com and then those records are connected with a line that says "A" for "DNS A records" and then that is connected to a line that says "FUNNULL's POP IP addresses"
This is a flow how how websites stay online in FUNNULL CDN Infrastructure](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fyqv2rchqyrfrjv63ltu3oca/bafkreifw3xqreiydd7t32osjroo6z2qdyfa3qwubquivrog425azhugtly@jpeg)
January 30, 2025 at 7:52 PM
... to connect up their criminal client websites through a series of CNAME records they control, which are then mapped to hundreds of IP addresses that are hosted at a variety of providers.
You can see this DNS data flow via the chart attached:
You can see this DNS data flow via the chart attached:
You can see this exact same behavior on their app-ads.txt file @ www.nytimes.com/app-ads.txt -- all DIRECT accountIDs, all owned by NYtimes directly.
If you are a publisher, this is the best way to prevent 3rd parties from selling your user data. But it's also complex and requires a big team.
If you are a publisher, this is the best way to prevent 3rd parties from selling your user data. But it's also complex and requires a big team.
January 10, 2025 at 1:57 AM
You can see this exact same behavior on their app-ads.txt file @ www.nytimes.com/app-ads.txt -- all DIRECT accountIDs, all owned by NYtimes directly.
If you are a publisher, this is the best way to prevent 3rd parties from selling your user data. But it's also complex and requires a big team.
If you are a publisher, this is the best way to prevent 3rd parties from selling your user data. But it's also complex and requires a big team.
All websites and apps need to appreciate that all vendors they list within their ads.txt + app-ads.txt are being given enough data about your users to sell it. That's why really serious orgs who really know what the fuck is going on with the bid stream like the NYTimes, have ZERO 3rd party vendors:
January 10, 2025 at 1:57 AM
All websites and apps need to appreciate that all vendors they list within their ads.txt + app-ads.txt are being given enough data about your users to sell it. That's why really serious orgs who really know what the fuck is going on with the bid stream like the NYTimes, have ZERO 3rd party vendors:
What annoys me the most about this beyond the macro privacy concerns of RTB? It's 2025 & app companies who have faced some of the biggest data privacy scandals in the world are still responding to reporters and sharing their "list of data partners" without including a link to their app-ads.txt file.
January 10, 2025 at 1:57 AM
What annoys me the most about this beyond the macro privacy concerns of RTB? It's 2025 & app companies who have faced some of the biggest data privacy scandals in the world are still responding to reporters and sharing their "list of data partners" without including a link to their app-ads.txt file.
imo it's really important to not muddle that Apple settled this case because Siri can unintentionally record conversations *but* Apple also said numerous times that the lawsuit's argument of "and the audio data was sold + used for ads" was basically laughable... Apple doesn't admit to this! ⤵️
January 2, 2025 at 8:24 PM
imo it's really important to not muddle that Apple settled this case because Siri can unintentionally record conversations *but* Apple also said numerous times that the lawsuit's argument of "and the audio data was sold + used for ads" was basically laughable... Apple doesn't admit to this! ⤵️
Our team believes that threat actors abusing cracked versions of Acunetix is a new threat vector for numerous enterprise organizations. Keep your eyes peeled for that scanner hitting your endpoints!
December 19, 2024 at 6:02 PM
Our team believes that threat actors abusing cracked versions of Acunetix is a new threat vector for numerous enterprise organizations. Keep your eyes peeled for that scanner hitting your endpoints!
Our team was able to acquire additional details about how Araneida works, and can report that the threat actors behind this are openly bragging in a Telegram channel about how many successful attacks the software has facilitated.
You can see the interface here in this video.
You can see the interface here in this video.
December 19, 2024 at 6:02 PM
Our team was able to acquire additional details about how Araneida works, and can report that the threat actors behind this are openly bragging in a Telegram channel about how many successful attacks the software has facilitated.
You can see the interface here in this video.
You can see the interface here in this video.
The most prominent effort to abuse a cracked copy of Acunetix is a tool called “Araneida scanner” – this was first mentioned publicly last year as having the SSL certificate from Acunetix from Chris Duggan at TLP R3D Intelligence Ltd.
![Screenshot of the tweet from @ x[.]com/TLP_R3D/status/1665777020767293447
with the text 1/2 🕵️♂️💻 Stellar insight from
@FalconFeedsio
on Araneida - the scanner & dumper tool.
The intriguing "Araneida Customer Panel" spotted on Shodan has got us digging deeper! 🌐🔍
We've got a lineup of 10 IPs featuring a sleek login panel:
🔹181.214.147.41 🔹181.214.147.110 🔹181.214.147.28 🔹181.214.147.111 🔹181.214.147.91 🔹181.214.147.115 🔹181.214.147.123 🔹181.214.147.132 🔹91.244.197.169 🔹181.214.147.40
A curious find: A self-signed cert dubbed "Acunetix Web Vulnerability Scanner" - an enigma.🔐🤔
Furthermore, the login panel leads to a ghost domain araneida[.]io, which remains unhosted. The plot thickens... #Pentesting #Araneida](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fyqv2rchqyrfrjv63ltu3oca/bafkreicw5ozdsu3fbftpwg4eoncqu7qsov36fix36kira3dhr2j4zvhwym@jpeg)
December 19, 2024 at 6:02 PM
The most prominent effort to abuse a cracked copy of Acunetix is a tool called “Araneida scanner” – this was first mentioned publicly last year as having the SSL certificate from Acunetix from Chris Duggan at TLP R3D Intelligence Ltd.
100% of the domains launched from this campaign are hosted across 2 IP addresses -- and there are dozens of similarly named domains mapped to these IP addresses.
![Screenshot of the Silent Push interface for the IP range 185.147.124[.]110 -- the screenshot includes rows and columns in dark black and grey with a list of domains in the left column that look similar.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fyqv2rchqyrfrjv63ltu3oca/bafkreiflblj6ctqxarrprjj4fvhbqxz6hh6enidbepechoqr2j2l7ws5se@jpeg)
December 13, 2024 at 9:43 PM
100% of the domains launched from this campaign are hosted across 2 IP addresses -- and there are dozens of similarly named domains mapped to these IP addresses.