-

Statement on the November 18, 2025 Court Decision in Quezon City
In June 2022, in the Philippines, the National Security Adviser Hermogenes Esperon requested that the National Telecommunications Commission direct all internet service providers to block access to several independent news websites. This request resulted in a memorandum sent to the ISPs, which led to the blocking of Bulatlat and Pinoy Weekly, both of which were
-

Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media
The Russian investigative media iStories received a series of Denial of Service attacks in early November 2025. At peak the website was flooded by more than 30.000 IP addresses. Although the attack infrastructure was globally distributed, a large portion of the flooding botnet was geo-located in Vietnam. Follow us on a journey to the tin-roof data center industry in Vietnam.
-

Catfish Incorporated: How the Dating Scam Industry Works
A year ago, during our investigation into the Russian disinformation operations known as “Doppelganger”, we uncovered that the same bulletproof hosting provider associated with the notorious Aeza (also known as Evilempire or Lethost) was being used to promote both Doppelganger’s front domains and various dating scams. We discovered that the infrastructure associated to disinformation hosted
-

Analysis of global takedown attempts targeting Qurium’s Bifrost Mirrors
Qurium Media Foundation has uncovered multiple takedown requests submitted to Google targeting its Bifrost mirror service, an initiative designed to keep independent journalism accessible in countries with heavy Internet censorship. Qurium’s investigation reveals coordinated international efforts to suppress journalism and erase investigative reporting through legal mechanisms. The takedown demands came from state-linked institutions and reputation management firms operating in Azerbaijan, Pakistan, Russia, and Venezuela.
-

Proxy provider connected to state sanctioned research center linked to attack against investigative media
Russian independent media outlets came under DDoS attack after publishing an investigation revealing how Russian oligarch and billionaire Oleg Deripaskaex been buying sex with minors.
-

Denial-of-Service Attacks on Investigative Media Traced to yet another Proxy Provider
Investigative media outlets Armando.info (Venezuela) and IDL Reporteros (Pero) have been targeted by a series of denial-of-service attacks. The DDoS attacks were once again traced to infrastructure operated by a proxy provider who lack adequate control over how their services are used by paying clients.
-

VoIP Providers serving the Scam Empire
Without the possibility of making thousands of phone calls per day to victims across the world, the scam call centers would not be “in business”. The vast majority of the calls are routed via five VoIP providers. This article reveals who the VoIP providers are, and why they have little interest in effective KYC and AML procedures to prevent fraud in their infrastructure.
-

Yet another proxy provider behind the iStories DoS attacks
iStories, independent Russian media outlet specializing in investigative journalism targeted by DDoS attack launched from proxy infrastructure. The very same proxy provider was involved in the DDoS attacks against Russian Meduza one year ago.
-

Disinformation, Malware and Drugs: Aeza’s cyber crime portfolio
On April 3, several members of the Aeza Group including two of their founders – Yuri Bozoyan and Arseny Penzev – were arrested for providing technical infrastructure of a darknet shop store known as BlackSprut.

