• Statement on the November 18, 2025 Court Decision in Quezon City

    Statement on the November 18, 2025 Court Decision in Quezon City

    In June 2022, in the Philippines, the National Security Adviser Hermogenes Esperon requested that the National Telecommunications Commission direct all internet service providers to block access to several independent news websites. This request resulted in a memorandum sent to the ISPs, which led to the blocking of Bulatlat and Pinoy Weekly, both of which were

    Read more

  • Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media

    Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media

    The Russian investigative media iStories received a series of Denial of Service attacks in early November 2025. At peak the website was flooded by more than 30.000 IP addresses. Although the attack infrastructure was globally distributed, a large portion of the flooding botnet was geo-located in Vietnam. Follow us on a journey to the tin-roof data center industry in Vietnam.

    Read more

  • Catfish Incorporated: How the Dating Scam Industry Works

    Catfish Incorporated: How the Dating Scam Industry Works

    A year ago, during our investigation into the Russian disinformation operations known as “Doppelganger”, we uncovered that the same bulletproof hosting provider associated with the notorious Aeza (also known as Evilempire or Lethost) was being used to promote both Doppelganger’s front domains and various dating scams. We discovered that the infrastructure associated to disinformation hosted

    Read more

  • Analysis of global takedown attempts targeting Qurium’s Bifrost Mirrors

    Analysis of global takedown attempts targeting Qurium’s Bifrost Mirrors

    Qurium Media Foundation has uncovered multiple takedown requests submitted to Google targeting its Bifrost mirror service, an initiative designed to keep independent journalism accessible in countries with heavy Internet censorship. Qurium’s investigation reveals coordinated international efforts to suppress journalism and erase investigative reporting through legal mechanisms. The takedown demands came from state-linked institutions and reputation management firms operating in Azerbaijan, Pakistan, Russia, and Venezuela.

    Read more

  • Proxy provider connected to state sanctioned research center linked to attack against investigative media

    Proxy provider connected to state sanctioned research center linked to attack against investigative media

    Russian independent media outlets came under DDoS attack after publishing an investigation revealing how Russian oligarch and billionaire Oleg Deripaskaex been buying sex with minors.

    Read more

  • Denial-of-Service Attacks on Investigative Media Traced to yet another Proxy Provider

    Denial-of-Service Attacks on Investigative Media Traced to yet another Proxy Provider

    Investigative media outlets Armando.info (Venezuela) and IDL Reporteros (Pero) have been targeted by a series of denial-of-service attacks. The DDoS attacks were once again traced to infrastructure operated by a proxy provider who lack adequate control over how their services are used by paying clients.

    Read more

  • VoIP Providers serving the Scam Empire

    VoIP Providers serving the Scam Empire

    Without the possibility of making thousands of phone calls per day to victims across the world, the scam call centers would not be “in business”. The vast majority of the calls are routed via five VoIP providers. This article reveals who the VoIP providers are, and why they have little interest in effective KYC and AML procedures to prevent fraud in their infrastructure.

    Read more

  • Yet another proxy provider behind the  iStories DoS attacks

    Yet another proxy provider behind the iStories DoS attacks

    iStories, independent Russian media outlet specializing in investigative journalism targeted by DDoS attack launched from proxy infrastructure. The very same proxy provider was involved in the DDoS attacks against Russian Meduza one year ago.

    Read more

  • Inside the Black Advertisement Agencies Operating in Meta

    Inside the Black Advertisement Agencies Operating in Meta

    An unfiltered conversation between Stan Sadokov (MultiLogin) and Blagoy Nikushev (Zmatic) on how to use Facebook infrastructure to black-hat advertisement campaigns. A playbook on tips and tricks to keep ads accounts alive, bypass restrictions and avoid blocking due to moderation.

    Read more

  • Disinformation, Malware and Drugs: Aeza’s cyber crime portfolio

    Disinformation, Malware and Drugs: Aeza’s cyber crime portfolio

    On April 3, several members of the Aeza Group including two of their founders – Yuri Bozoyan and Arseny Penzev – were arrested for providing technical infrastructure of a darknet shop store known as BlackSprut.

    Read more