IP ACTIVITY |
| 2023-06-11 | Guy Bruneau | DShield Honeypot Activity for May 2023 |
IP |
| 2025-02-15/a> | Xavier Mertens | The Danger of IP Volatility |
| 2024-11-22/a> | Xavier Mertens | An Infostealer Searching for « BIP-0039 » Data |
| 2024-10-17/a> | Guy Bruneau | Scanning Activity from Subnet 15.184.0.0/16 |
| 2024-09-26/a> | Johannes Ullrich | Patch for Critical CUPS vulnerability: Don't Panic |
| 2024-08-26/a> | Xavier Mertens | From Highly Obfuscated Batch File to XWorm and Redline |
| 2024-08-20/a> | Johannes Ullrich | Where are we with CVE-2024-38063: Microsoft IPv6 Vulnerability |
| 2024-08-01/a> | Johannes Ullrich | Tracking Proxy Scans with IPv4.Games |
| 2024-07-30/a> | Johannes Ullrich | Apple Patches Everything. July 2024 Edition |
| 2024-05-22/a> | Rob VandenBrink | NMAP Scanning without Scanning (Part 2) - The ipinfo API |
| 2024-04-25/a> | Jesse La Grew | Does it matter if iptables isn't running on my honeypot? |
| 2024-03-28/a> | Xavier Mertens | From JavaScript to AsyncRAT |
| 2024-03-14/a> | Jan Kopriva | Increase in the number of phishing messages pointing to IPFS and to R2 buckets |
| 2024-03-05/a> | Johannes Ullrich | Apple Releases iOS/iPadOS Updates with Zero Day Fixes. |
| 2024-02-21/a> | Jan Kopriva | Phishing pages hosted on archive.org |
| 2024-01-22/a> | Johannes Ullrich | Apple Updates Everything - New 0 Day in WebKit |
| 2024-01-12/a> | Xavier Mertens | One File, Two Payloads |
| 2023-12-11/a> | Johannes Ullrich | Apple Patches Everything |
| 2023-12-09/a> | Didier Stevens | IPv4-mapped IPv6 Address Used For Obfuscation |
| 2023-11-17/a> | Jan Kopriva | Phishing page with trivial anti-analysis features |
| 2023-10-25/a> | Johannes Ullrich | Apple Patches Everything. Releases iOS 17.1, MacOS 14.1 and updates for older versions fixing exploited vulnerability |
| 2023-10-23/a> | Johannes Ullrich | How an AppleTV may take down your (#IPv6) network |
| 2023-10-09/a> | Didier Stevens | ZIP's DOSTIME & DOSDATE Formats |
| 2023-10-07/a> | Didier Stevens | Binary IPv6 Addresses |
| 2023-10-05/a> | Jim Clausing | New tool: le-hex-to-ip.py |
| 2023-08-23/a> | Xavier Mertens | More Exotic Excel Files Dropping AgentTesla |
| 2023-07-29/a> | Xavier Mertens | Do Attackers Pay More Attention to IPv6? |
| 2023-07-26/a> | Xavier Mertens | Suspicious IP Addresses Avoided by Malware Samples |
| 2023-06-24/a> | Guy Bruneau | Email Spam with Attachment Modiloader |
| 2023-06-22/a> | Brad Duncan | Qakbot (Qbot) activity, obama271 distribution tag |
| 2023-06-22/a> | Johannes Ullrich | Apple Patches Exploited Vulnerabilities in iOS/iPadOS, macOS, watchOS and Safari |
| 2023-06-11/a> | Guy Bruneau | DShield Honeypot Activity for May 2023 |
| 2023-06-05/a> | Johannes Ullrich | Brute Forcing Simple Archive Passwords |
| 2023-05-20/a> | Xavier Mertens | Phishing Kit Collecting Victim's IP Address |
| 2023-05-18/a> | Johannes Ullrich | A Quick Survey of .zip Domains: Your highest risk is running into Rick Astley. |
| 2023-05-16/a> | Jesse La Grew | Signals Defense With Faraday Bags & Flipper Zero |
| 2023-03-27/a> | Johannes Ullrich | Apple Updates Everything (including Studio Display) |
| 2023-03-25/a> | Guy Bruneau | Microsoft Released an Update for Windows Snipping Tool Vulnerability |
| 2023-03-22/a> | Didier Stevens | Windows 11 Snipping Tool Privacy Bug: Inspecting PNG Files |
| 2023-02-28/a> | Brad Duncan | BB17 distribution Qakbot (Qbot) activity |
| 2023-02-06/a> | Johannes Ullrich | APIs Used by Bots to Detect Public IP address |
| 2023-01-24/a> | Johannes Ullrich | Apple Updates (almost) Everything: Patch Overview |
| 2023-01-17/a> | Johannes Ullrich | Packet Tuesday: IPv6 Router Advertisements https://www.youtube.com/watch?v=uRWpB_lYIZ8 |
| 2022-11-17/a> | Johannes Ullrich | Lessons Learned from Automatic Failover: When 8.8.8.8 "disappears". IPv6 to the Rescue? |
| 2022-11-04/a> | Xavier Mertens | Remcos Downloader with Unicode Obfuscation |
| 2022-10-21/a> | Brad Duncan | sczriptzzbn inject pushes malware for NetSupport RAT |
| 2022-10-16/a> | Didier Stevens | Video: Analysis of a Malicious HTML File (QBot) |
| 2022-10-13/a> | Didier Stevens | Analysis of a Malicious HTML File (QBot) |
| 2022-10-07/a> | Xavier Mertens | Critical Fortinet Vulnerability Ahead |
| 2022-08-17/a> | Johannes Ullrich | A Quick VoIP Experiment |
| 2022-08-14/a> | Johannes Ullrich | Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255 |
| 2022-08-11/a> | Xavier Mertens | InfoStealer Script Based on Curl and NSudo |
| 2022-07-20/a> | Johannes Ullrich | Apple Patches Everything Day |
| 2022-07-09/a> | Didier Stevens | 7-Zip Editing & MoW |
| 2022-07-04/a> | Didier Stevens | 7-Zip & MoW: "For Office files" |
| 2022-07-03/a> | Didier Stevens | 7-Zip & MoW |
| 2022-06-26/a> | Didier Stevens | My Paste Command |
| 2022-06-25/a> | Xavier Mertens | Malicious Code Passed to PowerShell via the Clipboard |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-06-16/a> | Xavier Mertens | Houdini is Back Delivered Through a JavaScript Dropper |
| 2022-06-04/a> | Guy Bruneau | Spam Email Contains a Very Large ISO file |
| 2022-06-01/a> | Jan Kopriva | HTML phishing attachments - now with anti-analysis features |
| 2022-05-20/a> | Xavier Mertens | A 'Zip Bomb' to Bypass Security Controls & Sandboxes |
| 2022-05-13/a> | Johannes Ullrich | From 0-Day to Mirai: 7 days of BIG-IP Exploits |
| 2022-05-09/a> | Xavier Mertens | Octopus Backdoor is Back with a New Embedded Obfuscated Bat File |
| 2022-05-08/a> | Johannes Ullrich | F5 BIG-IP Unauthenticated RCE Vulnerability (CVE-2022-1388) |
| 2022-04-21/a> | Xavier Mertens | Multi-Cryptocurrency Clipboard Swapper |
| 2022-04-20/a> | Brad Duncan | "aa" distribution Qakbot (Qbot) infection with DarkVNC traffic |
| 2022-03-31/a> | Johannes Ullrich | Apple Patches Actively Exploited Vulnerability in macOS, iOS and iPadOS, |
| 2022-03-14/a> | Johannes Ullrich | Apple Updates Everything: MacOS 12.3, XCode 13.3, tvOS 15.4, watchOS 8.5, iPadOS 15.4 and more |
| 2022-03-10/a> | Xavier Mertens | Credentials Leaks on VirusTotal |
| 2022-02-25/a> | Didier Stevens | Windows, Fixed IPv4 Addresses and APIPA |
| 2022-02-18/a> | Xavier Mertens | Remcos RAT Delivered Through Double Compressed Archive |
| 2022-02-10/a> | Johannes Ullrich | iOS/iPadOS and MacOS Update: Single WebKit 0-Day Vulnerability Patched |
| 2022-01-27/a> | Johannes Ullrich | Apple Patches Everything |
| 2022-01-18/a> | Jan Kopriva | Phishing e-mail with...an advertisement? |
| 2022-01-04/a> | Xavier Mertens | A Simple Batch File That Blocks People |
| 2021-11-18/a> | Xavier Mertens | JavaScript Downloader Delivers Agent Tesla Trojan |
| 2021-11-15/a> | Rob VandenBrink | Changing your AD Password Using the Clipboard - Not as Easy as You'd Think! |
| 2021-10-31/a> | Didier Stevens | Video: Phishing ZIP With Malformed Filename |
| 2021-10-24/a> | Didier Stevens | Phishing ZIP With Malformed Filename |
| 2021-10-21/a> | Brad Duncan | "Stolen Images Evidence" campaign pushes Sliver-based malware |
| 2021-10-07/a> | Johannes Ullrich | Who Is Hunting For Your IPTV Set-Top Box? |
| 2021-09-17/a> | Xavier Mertens | Malicious Calendar Subscriptions Are Back? |
| 2021-09-08/a> | Brad Duncan | "Stolen Images Evidence" Campaign Continues Pushing BazarLoader Malware |
| 2021-09-07/a> | Johannes Ullrich | Why I Gave Up on IPv6. And no, it is not because of security issues. |
| 2021-08-30/a> | Xavier Mertens | Cryptocurrency Clipboard Swapper Delivered With Love |
| 2021-08-29/a> | Guy Bruneau | Filter JSON Data by Value with Linux jq |
| 2021-08-13/a> | Brad Duncan | Example of Danabot distributed through malspam |
| 2021-07-26/a> | Didier Stevens | Failed Malspam: Recovering The Password |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-22/a> | Xavier Mertens | "Serverless" Phishing Campaign |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-05-10/a> | Johannes Ullrich | Correctly Validating IP Addresses: Why encoding matters for input validation. |
| 2021-05-08/a> | Guy Bruneau | Who is Probing the Internet for Research Purposes? |
| 2021-04-28/a> | Xavier Mertens | Deeper Analyzis of my Last Malicious PowerPoint Add-On |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-02-13/a> | Guy Bruneau | Using Logstash to Parse IPtables Firewall Logs |
| 2020-12-22/a> | Xavier Mertens | Malware Victim Selection Through WiFi Identification |
| 2020-11-13/a> | Xavier Mertens | Old Worm But New Obfuscation Technique |
| 2020-11-09/a> | Xavier Mertens | How Attackers Brush Up Their Malicious Scripts |
| 2020-11-06/a> | Johannes Ullrich | Rediscovering Limitations of Stateful Firewalls: "NAT Slipstreaming" ? Implications, Detections and Mitigations |
| 2020-10-24/a> | Guy Bruneau | An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1 |
| 2020-10-14/a> | Brad Duncan | More TA551 (Shathak) Word docs push IcedID (Bokbot) |
| 2020-09-11/a> | Rob VandenBrink | What's in Your Clipboard? Pillaging and Protecting the Clipboard |
| 2020-08-07/a> | Brad Duncan | TA551 (Shathak) Word docs push IcedID (Bokbot) |
| 2020-07-28/a> | Johannes Ullrich | All I want this Tuesday: More Data |
| 2020-07-27/a> | Johannes Ullrich | In Memory of Donald Smith |
| 2020-07-24/a> | Xavier Mertens | Compromized Desktop Applications by Web Technologies |
| 2020-07-06/a> | Johannes Ullrich | Summary of CVE-2020-5902 F5 BIG-IP RCE Vulnerability Exploits |
| 2020-07-05/a> | Didier Stevens | CVE-2020-5902 F5 BIG-IP Exploitation Attempt |
| 2020-06-11/a> | Xavier Mertens | Anti-Debugging JavaScript Techniques |
| 2020-06-08/a> | Didier Stevens | Translating BASE64 Obfuscated Scripts |
| 2020-05-13/a> | Brad Duncan | Malspam with links to zip archives pushes Dridex malware |
| 2020-05-08/a> | Xavier Mertens | Using Nmap As a Lightweight Vulnerability Scanner |
| 2020-05-03/a> | Didier Stevens | ZIP & AES |
| 2020-04-26/a> | Didier Stevens | Video: Malformed .docm File |
| 2020-04-08/a> | Brad Duncan | German malspam pushes ZLoader malware |
| 2020-04-04/a> | Didier Stevens | New Bypass Technique or Corrupt Word Document? |
| 2020-03-27/a> | Xavier Mertens | Malicious JavaScript Dropping Payload in the Registry |
| 2020-03-25/a> | Brad Duncan | Recent Dridex activity |
| 2020-02-28/a> | Xavier Mertens | Show me Your Clipboard Data! |
| 2020-02-22/a> | Xavier Mertens | Simple but Efficient VBScript Obfuscation |
| 2020-02-07/a> | Xavier Mertens | Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript |
| 2020-01-22/a> | Brad Duncan | German language malspam pushes Ursnif |
| 2020-01-15/a> | Johannes Ullrich | CVE-2020-0601 Followup |
| 2019-09-27/a> | Xavier Mertens | New Scans for Polycom Autoconfiguration Files |
| 2019-09-26/a> | Rob VandenBrink | Mining MAC Address and OUI Information |
| 2019-08-30/a> | Xavier Mertens | Malware Dropping a Local Node.js Instance |
| 2019-08-22/a> | Xavier Mertens | Simple Mimikatz & RDPWrapper Dropper |
| 2019-08-09/a> | Xavier Mertens | 100% JavaScript Phishing Page |
| 2019-06-20/a> | Xavier Mertens | Using a Travel Packing App for Infosec Purpose |
| 2019-06-10/a> | Xavier Mertens | Interesting JavaScript Obfuscation Example |
| 2019-03-15/a> | Remco Verhoef | Binary Analysis with Jupyter and Radare2 |
| 2019-03-14/a> | Didier Stevens | Tip: Ghidra & ZIP Files |
| 2019-02-24/a> | Guy Bruneau | Packet Editor and Builder by Colasoft |
| 2019-02-21/a> | Xavier Mertens | Simple Powershell Keyloggers are Back |
| 2019-02-07/a> | Xavier Mertens | Phishing Kit with JavaScript Keylogger |
| 2019-01-29/a> | Johannes Ullrich | A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) ) |
| 2018-12-17/a> | Didier Stevens | Password Protected ZIP with Maldoc |
| 2018-11-26/a> | Russ McRee | ViperMonkey: VBA maldoc deobfuscation |
| 2018-07-17/a> | Xavier Mertens | Searching for Geographically Improbable Login Attempts |
| 2018-07-13/a> | Xavier Mertens | Cryptominer Delivered Though Compromized JavaScript File |
| 2018-06-19/a> | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
| 2018-06-18/a> | Xavier Mertens | Malicious JavaScript Targeting Mobile Browsers |
| 2018-05-01/a> | Xavier Mertens | Diving into a Simple Maldoc Generator |
| 2018-03-01/a> | Johannes Ullrich | Why Does Emperor Xi Dislike Winnie the Pooh and Scrambled Eggs? |
| 2018-01-19/a> | Jim Clausing | Followup to IPv6 brute force and IPv6 blocking |
| 2018-01-09/a> | Jim Clausing | Are you watching for brute force attacks on IPv6? |
| 2017-11-17/a> | Xavier Mertens | Top-100 Malicious IP STIX Feed |
| 2017-10-25/a> | Mark Hofman | DUHK attack, continuing a week of named issues |
| 2017-09-13/a> | Rob VandenBrink | No IPv6? Challenge Accepted! (Part 1) |
| 2017-08-26/a> | Didier Stevens | Malware analysis: searching for dots |
| 2017-08-10/a> | Didier Stevens | Maldoc Analysis with ViperMonkey |
| 2017-07-08/a> | Xavier Mertens | A VBScript with Obfuscated Base64 Data |
| 2017-06-22/a> | Xavier Mertens | Obfuscating without XOR |
| 2017-04-02/a> | Guy Bruneau | IPFire - A Household Multipurpose Security Gateway |
| 2017-03-24/a> | Xavier Mertens | Nicely Obfuscated JavaScript Sample |
| 2017-03-10/a> | Xavier Mertens | The Side Effect of GeoIP Filters |
| 2017-03-04/a> | Xavier Mertens | How your pictures may affect your website reputation |
| 2017-02-28/a> | Johannes Ullrich | My Catch Of 4 Months In The Amazon IP Address Space |
| 2017-02-12/a> | Xavier Mertens | Analysis of a Suspicious Piece of JavaScript |
| 2017-02-02/a> | Rick Wanner | Multiple vulnerabilities discovered in popular printer models |
| 2016-12-13/a> | Xavier Mertens | UAC Bypass in JScript Dropper |
| 2016-11-22/a> | Didier Stevens | Update:ZIP With Comment |
| 2016-11-21/a> | Didier Stevens | ZIP With Comment |
| 2016-09-01/a> | Xavier Mertens | Maxmind.com (Ab)used As Anti-Analysis Technique |
| 2016-08-28/a> | Guy Bruneau | Spam with Obfuscated Javascript |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2016-06-18/a> | Rob VandenBrink | Controlling JavaScript Malware Before it Runs |
| 2016-04-27/a> | Tom Webb | Kippos Cousin Cowrie |
| 2016-02-20/a> | Didier Stevens | Locky: JavaScript Deobfuscation |
| 2016-02-07/a> | Xavier Mertens | More Malicious JavaScript Obfuscation |
| 2016-02-06/a> | Jim Clausing | More updates to kippo-log2db |
| 2016-02-02/a> | Johannes Ullrich | Targeted IPv6 Scans Using pool.ntp.org . |
| 2016-01-15/a> | Xavier Mertens | JavaScript Deobfuscation Tool |
| 2015-12-22/a> | Rick Wanner | The other Juniper vulnerability - CVE-2015-7756 |
| 2015-08-07/a> | Tony Carothers | Critical Firefox Update Today |
| 2015-06-02/a> | Alex Stanford | Guest Diary: Xavier Mertens - Playing with IP Reputation with Dshield & OSSEC |
| 2015-03-12/a> | Johannes Ullrich | Who got the bad SSL Certificate? Using tshark to analyze the SSL handshake. |
| 2015-02-07/a> | Jim Clausing | Update to kippo-log2db.pl |
| 2014-11-10/a> | Chris Mohan | Lessons Learn from attacks on Kippo honeypots |
| 2014-09-19/a> | Guy Bruneau | CipherShed Fork from TrueCrypt Project, Support Windows, Mac OS and Linux - https://ciphershed.org |
| 2014-09-03/a> | Johannes Ullrich | F5 BigIP Unauthenticated rsync Vulnerability |
| 2014-08-29/a> | Johannes Ullrich | False Positive or Not? Difficult to Analyze Javascript |
| 2014-08-12/a> | Adrien de Beaupre | Host discovery with nmap |
| 2014-07-23/a> | Johannes Ullrich | New Feature: "Live" SSH Brute Force Logs and New Kippo Client |
| 2014-07-22/a> | Daniel Wesemann | App "telemetry" |
| 2014-07-02/a> | Johannes Ullrich | Simple Javascript Extortion Scheme Advertised via Bing |
| 2014-07-01/a> | Johannes Ullrich | Microsoft No-IP Takedown |
| 2014-06-19/a> | Tony Carothers | New Supermicro IPMI/BMC Vulnerability |
| 2014-04-03/a> | Bojan Zdrnja | Watching the watchers |
| 2014-03-20/a> | Johannes Ullrich | Normalizing IPv6 Addresses |
| 2014-02-10/a> | Rob VandenBrink | Isn't it About Time to Get Moving on Chip and PIN? |
| 2014-01-30/a> | Johannes Ullrich | IPv6 and isc.sans.edu (Update) |
| 2014-01-17/a> | Russ McRee | Massive RFI scans likely a free web app vuln scanner rather than bots |
| 2014-01-13/a> | Johannes Ullrich | Got an IPv6 Firewall? |
| 2014-01-01/a> | Russ McRee | Six degrees of celebration: Juniper, ANT, Shodan, Maltego, Cisco, and Tails |
| 2013-12-21/a> | Guy Bruneau | Strange DNS Queries - Request for Packets |
| 2013-12-19/a> | Rob VandenBrink | Target US - Credit Card Data Breach |
| 2013-11-19/a> | Jim Clausing | Updated dumpdns.pl |
| 2013-11-06/a> | Johannes Ullrich | Rapid7 Discloses IPMI Vulnerabilities |
| 2013-11-04/a> | Manuel Humberto Santander Pelaez | When attackers use your DNS to check for the sites you are visiting |
| 2013-10-25/a> | Rob VandenBrink | Kaspersky flags TCPIP.SYS as Malware |
| 2013-09-05/a> | Rob VandenBrink | Building Your Own GPU Enabled Private Cloud |
| 2013-09-05/a> | Rob VandenBrink | What's Next for IPS? |
| 2013-09-02/a> | Guy Bruneau | Multiple Cisco Security Notice |
| 2013-08-07/a> | Johannes Ullrich | Firefox 23 and Mixed Active Content |
| 2013-07-25/a> | Johannes Ullrich | A Couple of SSH Brute Force Compromises |
| 2013-07-20/a> | Manuel Humberto Santander Pelaez | Do you have rogue Internet gateways in your network? Check it with nmap |
| 2013-07-12/a> | Johannes Ullrich | Microsoft Teredo Server "Sunset" |
| 2013-07-01/a> | Manuel Humberto Santander Pelaez | Using nmap scripts to enhance vulnerability asessment results |
| 2013-06-12/a> | Johannes Ullrich | Stupid Little IPv6 Tricks |
| 2013-05-20/a> | Johannes Ullrich | Ubuntu Package available to submit firewall logs to DShield |
| 2013-05-17/a> | Johannes Ullrich | SSL: Another reason not to ignore IPv6 |
| 2013-04-23/a> | Russ McRee | Microsoft's Security Intelligence Report (SIRv14) released |
| 2013-03-27/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - IPv6 moving target defense |
| 2013-03-25/a> | Johannes Ullrich | IPv6 Focus Month: IPv6 over IPv4 Preference |
| 2013-03-21/a> | Jim Clausing | IPv6 Focus Month: Guest Diary: Matthew Newton - IPv6 Cat Feeder - Turning those extra bits into bytes, literally |
| 2013-03-19/a> | Johannes Ullrich | IPv6 Focus Month: The warm and fuzzy side of IPv6 |
| 2013-03-18/a> | Johannes Ullrich | IPv6 Focus Month: What is changing with DHCP |
| 2013-03-13/a> | Johannes Ullrich | IPv6 Focus Month: Kaspersky Firewall IPv6 Vulnerability |
| 2013-03-12/a> | Swa Frantzen | IPv6 Focus Month: How to say no! |
| 2013-03-11/a> | Richard Porter | IPv6 Focus Month: Traffic Testing, Firewalls, ACLs, pt 1 |
| 2013-03-09/a> | Guy Bruneau | IPv6 Focus Month: IPv6 Encapsulation - Protocol 41 |
| 2013-03-08/a> | Johannes Ullrich | IPv6 Focus Month: Filtering ICMPv6 at the Border |
| 2013-03-07/a> | Rob VandenBrink | IPv6 Focus Month: Barriers to Implementing IPv6 |
| 2013-03-06/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses |
| 2013-03-05/a> | Mark Hofman | IPv6 Focus Month: Device Defaults |
| 2013-03-04/a> | Johannes Ullrich | IPv6 Focus Month: Addresses |
| 2013-03-01/a> | Jim Clausing | IPv6 Focus Month at the Internet Storm Center |
| 2013-02-11/a> | John Bambenek | Is This Chinese Registrar Really Trying to XSS Me? |
| 2013-02-08/a> | Kevin Shortt | Is it Spam or Is it Malware? |
| 2013-02-04/a> | Russ McRee | An expose of a recent SANS GIAC XSS vulnerability |
| 2013-01-31/a> | Johannes Ullrich | IPv6 Focus Month |
| 2013-01-30/a> | Richard Porter | Getting Involved with the Local Community |
| 2013-01-25/a> | Johannes Ullrich | Vulnerability Scans via Search Engines (Request for Logs) |
| 2013-01-10/a> | Rob VandenBrink | What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too! |
| 2012-12-06/a> | Johannes Ullrich | How to identify if you are behind a "Transparent Proxy" |
| 2012-10-06/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 6 - NERC: The standard that enforces security on power SCADA |
| 2012-10-04/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 4: Crypto Standards |
| 2012-09-05/a> | Rob VandenBrink | Auditing a Network for VOIP Call Quality Metrics |
| 2012-08-16/a> | Johannes Ullrich | A Poor Man's DNS Anomaly Detection Script |
| 2012-07-21/a> | Rick Wanner | TippingPoint DNS Version Request increase |
| 2012-07-18/a> | Rob VandenBrink | Snort Updated today |
| 2012-06-25/a> | Guy Bruneau | Using JSDetox to Analyze and Deobfuscate Javascript |
| 2012-06-07/a> | Johannes Ullrich | IPMI: Hacking servers that are turned "off" |
| 2012-06-01/a> | Johannes Ullrich | What Does "IPv6 Day" mean to you? |
| 2012-05-31/a> | Johannes Ullrich | SCADA@Home: Your health is no secret no more! |
| 2012-05-22/a> | Johannes Ullrich | nmap 6 released |
| 2012-05-17/a> | Johannes Ullrich | New IPv6 Video: IPv6 Router Advertisements https://isc.sans.edu/ipv6videos |
| 2012-05-07/a> | Guy Bruneau | iOS 5.1.1 Software Update for iPod, iPhone, iPad |
| 2012-05-06/a> | Jim Clausing | Tool updates and Win 8 |
| 2012-04-25/a> | Daniel Wesemann | Blacole's obfuscated JavaScript |
| 2012-01-22/a> | Johannes Ullrich | Javascript DDoS Tool Analysis |
| 2012-01-12/a> | Rob VandenBrink | Stuff I Learned Scripting - Fun with STDERR |
| 2012-01-03/a> | Bojan Zdrnja | The tale of obfuscated JavaScript continues |
| 2011-12-21/a> | Chris Mohan | The off switch |
| 2011-12-07/a> | Lenny Zeltser | V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation |
| 2011-11-10/a> | Rob VandenBrink | Stuff I Learned Scripting - - Parsing XML in a One-Liner |
| 2011-11-07/a> | Rob VandenBrink | Stuff I Learned Scripting - Evaluating a Remote SSL Certificate |
| 2011-11-07/a> | Rob VandenBrink | Juniper BGP issues causing locallized Internet Problems |
| 2011-11-04/a> | Guy Bruneau | New Poll: In the coming 12 months, what is your deployment plan or status with IPv6? |
| 2011-10-23/a> | Guy Bruneau | tcpdump and IPv6 |
| 2011-09-29/a> | Daniel Wesemann | The SSD dilemma |
| 2011-09-09/a> | Guy Bruneau | IPv6 and DNS Sinkhole |
| 2011-08-24/a> | Rob VandenBrink | Citrix Access Gateway Cross Site Scripting vulnerability and fix ==> http://support.citrix.com/article/CTX129971 |
| 2011-08-22/a> | Jim Clausing | Are your tools ready for IPv6? (part 2) |
| 2011-08-04/a> | Jim Clausing | Are your tools ready for IPv6? (part 1) |
| 2011-07-27/a> | Johannes Ullrich | Internet Storm Center iPhone App now available. Feedback/Feature Requests welcome. Search App Store for "ISC Reader" |
| 2011-07-09/a> | Tony Carothers | Copyright Alert System - What say you? |
| 2011-06-17/a> | Richard Porter | When do you stop owning Technology? |
| 2011-06-09/a> | Johannes Ullrich | IPv6 Day Summary |
| 2011-06-08/a> | Johannes Ullrich | IPv6 Day Started |
| 2011-06-06/a> | Manuel Humberto Santander Pelaez | Phishing: Same goal, same techniques and people still falling for such scams |
| 2011-06-02/a> | Johannes Ullrich | IPv6 RA-Guard: How it works and how to defeat it |
| 2011-06-01/a> | Johannes Ullrich | Enabling Privacy Enhanced Addresses for IPv6 |
| 2011-05-03/a> | Johannes Ullrich | Analyzing Teredo with tshark and Wireshark |
| 2011-04-25/a> | Rob VandenBrink | What's Your (IP) Address Worth? |
| 2011-04-23/a> | Manuel Humberto Santander Pelaez | Image search can lead to malware download |
| 2011-04-22/a> | Manuel Humberto Santander Pelaez | iPhoneMap: iPhoneTracker port to Linux |
| 2011-04-20/a> | Johannes Ullrich | iPhone GPS Data Storage |
| 2011-04-11/a> | Johannes Ullrich | Layer 2 DoS and other IPv6 Tricks |
| 2011-04-05/a> | Johannes Ullrich | IPv6 MITM via fake router advertisements |
| 2011-02-08/a> | Johannes Ullrich | Tippingpoint Releases Details on Unpatched Bugs |
| 2011-02-01/a> | Johannes Ullrich | The End Of IP As We Know It |
| 2011-01-24/a> | Rob VandenBrink | Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool |
| 2011-01-05/a> | Johannes Ullrich | ipv6finder : How ready are you for IPv6? |
| 2010-12-02/a> | Kevin Johnson | Robert Hansen and our happiness |
| 2010-11-29/a> | Stephen Hall | iPhone phishing - What you see, isn't what you get |
| 2010-11-08/a> | Manuel Humberto Santander Pelaez | Network Security Perimeter: How to choose the correct firewall and IPS for your environment? |
| 2010-08-06/a> | Rob VandenBrink | FOXIT PDF Reader update to resolve iPhone/iPad Jailbreak issue ==> http://www.foxitsoftware.com/announcements/2010861227.html |
| 2010-08-01/a> | Manuel Humberto Santander Pelaez | Evation because IPS fails to validate TCP checksums? |
| 2010-07-29/a> | Rob VandenBrink | NoScript 2.0 released |
| 2010-07-29/a> | Rob VandenBrink | FBI, Slovenian and Spanish Police announce more arrests of Mariposa Botnet Creator, Operators |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | Malware inside PDF Files |
| 2010-06-23/a> | Johannes Ullrich | IPv6 Support in iOS 4 |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | TCP evasions for IDS/IPS |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | iPhone 4 Order Security Breach Exposes Private Information |
| 2010-06-10/a> | Deborah Hale | iPad Owners Exposed |
| 2010-04-15/a> | Mark Hofman | SIP Attacks on internet connected port5060 targeting Asterix servers |
| 2010-03-24/a> | Kyle Haugsness | Wikipedia outage |
| 2010-03-21/a> | Scott Fendley | Skipfish - Web Application Security Tool |
| 2010-03-05/a> | Kyle Haugsness | Javascript obfuscators used in the wild |
| 2010-02-26/a> | Rick Wanner | NIST Guidelines for Secure Deployment of IPv6 - http://csrc.nist.gov/publications/drafts/800-119/draft-sp800-119_feb2010.pdf |
| 2010-02-16/a> | Jim Clausing | Teredo request for packets |
| 2010-02-16/a> | Johannes Ullrich | Teredo "stray packet" analysis |
| 2010-02-03/a> | Rob VandenBrink | APPLE-SA-2010-02-02-1 iPhone OS 3.1.3 and iPhone OS 3.1.3 for iPod touch |
| 2010-02-02/a> | Johannes Ullrich | New IPv6 Screencast Videos: http://isc.sans.org/ipv6videos (Today: blocking and detecting IPv6 in Linux) |
| 2010-01-19/a> | Jim Clausing | 49Gbps DDoS, IPv4 exhaustion, and DNSSEC, oh my! |
| 2010-01-12/a> | Johannes Ullrich | IPv6 and isc.sans.org |
| 2010-01-06/a> | Johannes Ullrich | Denial of Service Attack Aftermath (and what did Iran have to do with it?) |
| 2010-01-06/a> | Johannes Ullrich | New Tool: IPv6 conversions http://isc.sans.org/tools/ipv6.html |
| 2009-12-21/a> | Marcus Sachs | iPhone Botnet Analysis |
| 2009-11-09/a> | Chris Carboni | 80's Flashback on Jailbroken iPhones |
| 2009-11-08/a> | Bojan Zdrnja | iPhone worm in the wild |
| 2009-10-20/a> | Raul Siles | Cyber Security Awareness Month - Day 20 - Ports 5060 & 5061 - SIP (VoIP) |
| 2009-09-12/a> | Jim Clausing | Apple Updates |
| 2009-09-07/a> | Jim Clausing | Request for packets |
| 2009-08-28/a> | Adrien de Beaupre | WPA with TKIP done |
| 2009-07-31/a> | Deborah Hale | The iPhone patch is out |
| 2009-07-30/a> | Deborah Hale | iPhone Hijack |
| 2009-06-06/a> | Patrick Nolan | ARRA/HIPAA Breach Reporting Dates Approaching |
| 2009-05-09/a> | Patrick Nolan | Unusable, Unreadable, or Indecipherable? No Breach reporting required |
| 2009-05-04/a> | Tom Liston | Adobe Reader/Acrobat Critical Vulnerability |
| 2009-04-30/a> | Marcus Sachs | ARIN Notification Concerning IPv6 |
| 2009-04-18/a> | Johannes Ullrich | Twitter Packet Challenge Solution |
| 2009-04-07/a> | Bojan Zdrnja | Advanced JavaScript obfuscation (or why signature scanning is a failure) |
| 2009-04-02/a> | Bojan Zdrnja | JavaScript insertion and log deletion attack tools |
| 2009-03-24/a> | G. N. White | PSYB0T: A MIPS-device (mipsel) IRC Bot |
| 2009-03-22/a> | Mari Nichols | Dealing with Security Challenges |
| 2009-03-01/a> | Jim Clausing | Cool combination of tools |
| 2009-02-25/a> | Andre Ludwig | Adobe Acrobat pdf 0-day exploit, No JavaScript needed! |
| 2009-02-25/a> | Andre Ludwig | Preview/Iphone/Linux pdf issues |
| 2009-02-13/a> | Kevin Liston | Canada Calling |
| 2008-12-13/a> | Jim Clausing | Followup from last shift and some research to do. |
| 2008-11-17/a> | Jim Clausing | How are you coming with that IPv6 migration? |
| 2008-10-20/a> | Johannes Ullrich | Fraudulent ATM Reactivation Phone Calls. |
| 2008-10-01/a> | Rick Wanner | Handler Mailbag |
| 2008-09-10/a> | Adrien de Beaupre | Apple updates iPod Touch + Bonjour for Windows |
| 2008-09-08/a> | Raul Siles | VoIP Attacks: Reverse Vhising, SEO and Phone Number Authentication |
| 2008-07-14/a> | Daniel Wesemann | Obfuscated JavaScript Redux |
| 2008-07-11/a> | Jim Clausing | Handling the load |
| 2008-06-30/a> | Marcus Sachs | More SQL Injection with Fast Flux hosting |
| 2008-06-18/a> | Chris Carboni | Cisco Security Advisory |
| 2008-05-20/a> | Raul Siles | List of malicious domains inserted through SQL injection |
| 2008-04-29/a> | Bojan Zdrnja | Scripts in ASF files |
| 2008-04-06/a> | Daniel Wesemann | Advanced obfuscated JavaScript analysis |
| 2008-04-03/a> | Bojan Zdrnja | Mixed (VBScript and JavaScript) obfuscation |
ACTIVITY |
| 2024-02-03/a> | Guy Bruneau | DShield Sensor Log Collection with Elasticsearch |
| 2023-11-27/a> | Guy Bruneau | Decoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary] |
| 2023-08-12/a> | Guy Bruneau | DShield Sensor Monitoring with a Docker ELK Stack [Guest Diary] |
| 2023-06-11/a> | Guy Bruneau | DShield Honeypot Activity for May 2023 |
| 2021-02-13/a> | Guy Bruneau | Using Logstash to Parse IPtables Firewall Logs |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-03-15/a> | Guy Bruneau | VPN Access and Activity Monitoring |
| 2014-07-26/a> | Chris Mohan | "Internet scanning project" scans |
| 2014-03-14/a> | Richard Porter | Word Press Shenanigans? Anyone seeing strange activity today? |
| 2014-02-14/a> | Chris Mohan | Scanning activity for /siemens/bootstrapping/JnlpBrowser/Development/ |
| 2014-01-31/a> | Chris Mohan | Looking for packets from three particular subnets |
| 2013-10-12/a> | Richard Porter | Reported Spike in tcp/5901 and tcp/5900 |
