Verified investigations, threat actor unmaskings and open-source intelligence briefings. Every report is reviewed before it enters the feed.
FEATURED REPORT
A comprehensive OSINT investigation unmasking "Anonymous2090"—a highly destructive data broker targeting MENA infrastructure—revealing him as a lone Yemeni operator based in Sana'a through critical OPSEC failures, Telegram leaks, and infostealer logs.
RedFoxIQ, an Iraqi threat actor responsible for extensive database exfiltrations, was successfully de-anonymized as Ahmed Ali Ismael Al-jebori due to critical operational security failures. Investigators uncovered his true identity by tracking immutable Telegram IDs, reused cross-platform handles, exposed GitHub metadata, and careless screen recordings that revealed his real name and phone number.
$WUMP airdrop—masked behind abused German server locations—ultimately unraveled across$HIPO and ZYNC due to leaked Iranian connection telemetry and sloppy infrastructure sharing. These compounding OPSEC failures directly unmasked the operation's sole architect, 37-year-old Iranian operator Mostafa Forouji.
Adjust the search term or clear the active filter.