In recent months I had asked why my account was suspended. After a few months I received this answer. There is no possibility of dialogue and not even a decent explanation. They talk to me generically about a violation of the rules.
Now we need to understand whether this response is the result of poorly made artificial intelligence or of a biological moron 😀 😀 😀
After Twitter blocked my account I moved to Urlscan.io where Johannes welcomed and supported me very kindly. I was able to appreciate the platform and today we reached the milestone of one million submissions made.
Thanks to the urlscan.io team for their work!
I think it’s been about 30 years since I’ve installed a game on my computer. The last one I think was Gunship 2000 or something!
Today, however, I installed this simulator for model aircraft.
From the videos and comments it seemed like a well-made product and so I decided to buy it to learn how to drive model aircraft and to be able to do something useful during some online meetings.
I had read about some problems with Intel graphics cards but being an optimist I decided I would fix it. Indeed it was, I had to work on it a bit but in the end everything works 🙂
After installing it using Steam (which I didn’t know about but it seems to me a fantastic object) the game started without problems, only that instead of letting me do anything it presented me with a model aircraft stopped on the runway. Searching on the Internet on the various forums there was talk of switching to the use of the beta version “dxvk-intel.fix” which could have solved the problem.
To use the beta version, simply enter the game properties, select the “Betas” item, select the “dxvk-intel-fix” beta, close the window with the “x” and restart the game.
When I restarted the game I got an error message telling me that the graphics card was not working properly. To solve this problem I downloaded these drivers and after the installation I restarted my computer as requested and after the reboot everything started working fine 🙂
After more than 400,000 tweets, the blue bird platform suspended my account for violating the counterfeit goods rules.
I’ve decided to move the publishing of reports to urlscan.io.
In the new release I made some changes to the publishing platform, the main one for users is that now sites that don’t have a default page are also published. These are the so-called “opendir”.
November 2022 saw a new update of “The Smith Project” solution.
This update makes it possible to identify a new type of malicious sites that spread malicious Android app and Windows executable.
The increase in tweets from October to November was almost 100%. If compared with September the increase was more than 200%
It’s hard to find time to work on this project, however there are many ideas. Stay tuned!
I just released a web application for generating typos. This service exposes a resource that can simply be invoked by the browser or any http client (eg curl) and returns a list of strings that look like the original string. For now the request is not that much customizable, the next releases will allow you to configure the algorithm that generates the strings.
The application can be found here: http://typ0generat0r.com
The application is available to everyone with few limitations:
To overcome these limits you can ask me for a key through which you can use the application without limitations,
A Platform for Automated Threat Report Collection and IOC Extraction
A few days ago I came across this project from the University of Madrid. Below is a summary and the entire document. Enjoy the reading 🙂
To adapt to a constantly evolving landscape of cyber threats, organizations actively need to collect Indicators of Compromise (IOCs), i.e., forensic artifacts that signal that a host or network might have been compromised. IOCs can be collected through open-source and commercial structured IOC feeds. But, they can also be extracted from a myriad of unstructured threat reports written in natural language and distributed using a wide array of sources such as blogs
and social media. This work presents GoodFATR an automated platform for collecting threat reports from a wealth of sources and extracting IOCs from them. GoodFATR supports 6 sources: RSS, Twitter, Telegram, Malpedia, APTnotes, and ChainSmith. GoodFATR continuously monitors the sources, downloads new threat reports, extracts 41 indicator types from the collected reports, and filters generic indicators to output the IOCs. We propose a novel majority-vote methodology for evaluating the accuracy of indicator extraction tools, and apply it to compare 7 popular tools with GoodFATR’s indicator extraction module. We run GoodFATR over 15 months to collect 472,891 reports from the 6 sources; extract 1,043,932 indicators from the reports; and identify 655,971 IOCs. We analyze the collected data to identify the top IOC contributors and the IOC class distribution. Finally, we present a case study on how GoodFATR can assist in tracking cybercrime relations on the Bitcoin blockchain.
An interesting article by Namecheap that illustrates their commitment (and to a small extent mine too) in the fight against scams and abuses on the Internet.
It seems to me yesterday that I connected The Smith Agent to my Twitter account, perhaps more out of curiosity than out of wanting to do something useful, and today the account has exceeded 200,000 tweets 🙂
How fast these kids grow up!
To celebrate the milestone I decided to write an updated post compared to the previous one in which I told a little about what happens under the hood of the project.
Let’s talk a little about the various components that make up the project.
Zefiro collects information related to internet domains. This process leads to the production of lists of recently registered domains.
Scirocco collects information from Certificate Transparency Logs. This information is useful for identifying new domains and subdomains.
Watson uses Certificate Transparency Logs data to identify domains registered in the last few hours. For its operation this component uses agents distributed in various datacenters around the world.
Miniluv uses data from Zefiro, Scirocco and Watson to select new domains and distribute this information to subscribers, both internal and external to the solution.
Smith Core orchestrates the functioning of the Smith agents by dividing the work on the various distributed components.
Hammer takes care of keeping monitoring active on sites that have some characteristics and that are therefore entrusted to his care.
The Smith agent are in charge of checking the context of the domain, hosting and the contents that the site displays. This information helps to create a score that identifies the possible danger of the site. If the threat is certainly identified, the Twitter report will report the words “Threat …”, if the threat is in doubt the words will be “Possible threat …”. For its operation this component uses agents distributed in various datacenters around the world.
All these components are based on .NET (Framework and Core), the databases are managed by SQL Server. The operating systems used are Windows 2019 and Linux Ubuntu.
One of the main objectives of the platform is the collection of phishing kits and malware.
Currently these files are saved but in the future (hopefully near) they will be shared to create IoCs and datasets to be used for training artificial intelligence models useful for improving threat discovery techniques. The idea is to improve the ability to discover threats using the information contained in threats already discovered.
Another future evolution of the platform will be the integration with email services to report malicious and compromised accounts in order to reduce damage and speed up investigations, as is already the case with some service providers or partners who deal with managing these reports when relevant to them.
Emiliano Carlesi's blog 
You must be logged in to post a comment.