Your Filenames Are for Sale: The .md Namespace Collision
A correction and a follow up to our February investigation. Markdown filenames are buyable domains, because .md is Moldova’s country code TLD. We tested …
Investigations
In-depth research into fraud, disclosure violations, and consumer harm. Evidence-based, publicly documented, filed with relevant authorities.
MuddyWater Follow-Up: April 2026
A lot changed in four weeks. MuddyWater rebuilt their toolkit in Rust, started using AI to write malware, compromised US banks and airports, and picked up new …
Cracking the Factory: When 'Random' Passwords Aren't
Every password your computer has ever generated is the output of a deterministic algorithm. When that algorithm is weak, fingerprinted, or seeded from a …
MuddyWater: Inside Iran's Cyber War Machine
A comprehensive look at MuddyWater, the Iranian APT embedded in US banks and airports before the bombs even fell. From Operation Olalampo to exposed server …
.md TLD: Namespace Collision Threat to AI Agents
Investigation reveals Moldova's .md TLD domains are actively detecting AI agents, creating pre-positioned attack infrastructure for future prompt injection.
The Norwegian Gateway: ITavisen, CryptoEasily, and the Myth of 'Norsk er Trygt'
Part 2 of our investigation into ITavisen’s promotion of CryptoEasily. Documenting victim testimony, regulatory failures, the eToro/Plus500 connection, …
CryptoEasily Cloud Mining Scheme Investigation
Investigation report documenting a cryptocurrency investment scam operating through ITavisen.no and coordinated syndication across multiple platforms.