DEV Community: Daniel J

Are stereograms bad for your eyes? What the evidence says

Daniel J — Mon, 02 Nov 2026 14:03:30 +0000

Stereograms, often called Magic Eye pictures (the name is a trademark of Magic Eye Inc., which has no affiliation with The Week Eye), hide a 3D word or shape inside a flat pattern. Every weekly hidden 3D puzzle on The Week Eye is one.

Are stereograms bad for your eyes?

Stereograms are bad for your eyes only in the short term: they can cause eye strain, headaches or blurred vision, and no published study has found lasting harm. The strain comes from holding your eyes in an unusual position, and it belongs to the same family as the strain from long reading or screen work.

The American Academy of Ophthalmology (AAO) groups screen eye strain with the strain from reading and other close work, and it calls the belief that screens permanently damage your eyes untrue. Symptoms it lists include blurred vision and eyes that feel achy, dry or stinging.

Why stereograms can make your eyes hurt

Stereograms make your eyes hurt because they pull apart two actions your eyes normally perform together: aiming and focusing.

When you look at a real object, both eyes turn to point at it (vergence) and the lens in each eye changes shape to bring it into focus (accommodation). The two responses are coupled, so a change in one drives the other, as Hoffman, Girshick, Akeley and Banks explain in the Journal of Vision (2008). A stereogram breaks that link. Your eyes aim at a point behind the screen to fuse the pattern, while focus has to stay on the screen surface or the dots blur. Cisarik and colleagues (Perception, 2012) describe this split as the requirement for seeing an autostereogram. The guide to how stereograms encode depth in a repeating pattern covers the image side.

Researchers call this split vergence-accommodation conflict. Hoffman's team tested it on a 3D display: eye-related fatigue and discomfort scores were worse when the aiming and focus distances differed than when they matched, while neck and back symptoms did not differ. Their display used stereo images rather than a single printed pattern, but it imposed the same mismatch on the eyes.

Screens add a second strain. The AAO reports that people blink only about 5 to 7 times a minute while using a screen, which dries the eye surface.

Relax your eyes and look through the screen, as if at something far behind it, until a large square floats out of the pattern.

Can stereograms damage your eyes?

No published study reports lasting eye damage from stereograms. A PubMed search run for this article on November 2, 2026 returned no paper that measured damage, fatigue or other adverse effects from autostereograms, and the six papers indexed under "autostereogram" cover their history, their image design and the visual skills needed to see them.

The closest evidence comes from convergence exercises, which train the same eye-aiming system on purpose. Across 12 trials with 1,289 people, the Cochrane review of convergence insufficiency treatments found that no study, in children or adults, reported adverse effects from the treatments. Those trials tested clinical exercises, so they leave hidden 3D pictures themselves unstudied.

Are stereograms good for your eyes or brain?

No published trial shows that viewing stereograms makes healthy eyes or brains work better. Stereogram skill does track how well your two eyes work together.

In a 2008 study of 194 people by Wilmer and Backus, those who said they were poor at seeing stereograms had a five-fold higher risk of impaired stereo vision on a standard clinical test. A 2012 study of 69 people linked the time it took to see a hidden shape to stereo acuity and convergence measures. Its authors wrote that it is uncertain whether stereograms are useful in clinical practice.

Practice can change depth perception under lab conditions. Ding and Levi (PNAS, 2011) trained five adults with strabismus or amblyopia whose stereo vision was absent or weak, and after thousands of training trials with stereoscopic gratings they recovered some stereo vision. That protocol used controlled sine-wave stimuli in a lab. The same PubMed search found no trial of stereograms as a memory, attention or brain-training exercise.

Can hidden 3D pictures improve your vision?

No peer-reviewed study supports the claim that hidden 3D pictures improve vision. The claim appears in book marketing.

The sixth book in that trademarked series, Beyond 3D: Improve Your Vision (2004), co-written with Marc Grossman, says it "helps promote healthy vision" and lists benefits that "may result." The publisher's description cites no studies for them.

Claim in the book description	What published research shows
Improved overall vision	No trial found
Reduced computer eyestrain	The aiming-focus mismatch increased eye fatigue in Hoffman et al. (2008)
Lower stress	No trial found
Longer attention span	No trial found

Stereogram eye exercises are convergence cards

The stereogram eye exercises that eye clinics prescribe are printed convergence cards for convergence insufficiency, a condition in which the eyes drift outward and struggle to work together for close viewing.

The Evelina London (NHS) stereogram leaflet describes a card printed with two incomplete cat pictures. The patient holds it at arm's length, follows a pen tip toward the face, and merges the cats into one complete cat. An orthoptist explains and demonstrates the exercise first. A random-dot hidden 3D picture hides a shape in a repeating texture and comes with no treatment plan.

The Cochrane review (evidence current to September 2019) found high-certainty evidence that, in children, office-based therapy with home reinforcement worked better than placebo, home pencil push-ups and home computer therapy. In adults the results were less clear, and symptom changes showed no difference between treatments.

How to view stereograms comfortably

View stereograms in short sessions, at a normal screen distance, with relaxed parallel viewing, and stop if anything hurts.

Take breaks. Between attempts, look at an object in the distance for a while, as the AAO advises for screen work.
Sit about 25 inches, roughly arm's length, from a desktop screen, the distance the AAO recommends. The free step-by-step viewing lessons start with your face close to the screen and have you lean back slowly while holding a relaxed focus.
Use parallel viewing. Every puzzle here is made for it: your eyes relax as if looking into the distance. Crossing your eyes reverses the depth and can feel harder to hold, as the parallel vs cross-eyed viewing guide explains.
Keep your normal glasses on and cut glare by dimming room lights or tilting the screen.
Stop at pain or double vision, and rest until your eyes feel normal.
Keep sittings short. Eye Trials allows one guess a day, so each session lasts one attempt.

When to see an eye doctor

See an eye doctor if double vision or headaches continue after you stop viewing, or if a child cannot see any stereogram after practice. The AAO advises speaking with an ophthalmologist about any unusual vision symptoms.

About 7% of adults under 60 lack stereo vision, according to a 2019 evidence synthesis by Chopin, Bavelier and Levi, and the Wilmer and Backus study found that poor stereogram skill predicts impaired stereo vision. In a child, weak stereo vision deserves an exam because amblyopia, or lazy eye, responds best to early care: the AAO says it should be treated before age 7 or 8 for best results, and a child may not know one eye sees better than the other.

Before booking, work through the common reasons people cannot see stereograms. Browser zoom, focusing on the screen and crossed eyes come first, and stereo blindness is the last item.

Frequently asked questions

Is it bad to look at stereograms every day?

No study has tested daily stereogram viewing. Take the breaks the AAO recommends for close work, and stop whenever your eyes hurt.

Are stereograms safe for children?

No study has found harm to children from stereograms. Use the same limits as for adults, and book an eye exam for a child who reports double vision or cannot see any hidden picture after practice.

Does Magic Eye improve vision?

No controlled study shows that stereogram books improve vision. The vision claims in those books come from their authors and publishers, without cited trials.

Can I do stereogram eye exercises at home instead of seeing an orthoptist?

Home exercise alone performed worse in children in the Cochrane review: office-based therapy with home reinforcement beat home pencil push-ups and home computer therapy. Get convergence exercises from an orthoptist or eye doctor, who also checks the diagnosis.

How long should a stereogram session last?

No study sets a safe length. Stop at the first ache, blur or double vision; this week's puzzle needs one correct look, and the timer stops when you type the answer.

crt.sh alternatives: certificate transparency search tools compared

Daniel J — Sun, 01 Nov 2026 16:17:02 +0000

crt.sh is the best-known free certificate transparency search, and it has returned 502 errors and slow searches for most of 2026. The tool to use instead depends on the question:

Question	Use
Older certificates for a domain, free	crt.sh, when it answers
Current certificates for a domain, by API, free	SSLMate Cert Spotter
Subdomains of a domain, with typo-matching search	Merklemap
Which hosts serve a certificate right now	Censys or Shodan
Certificates issued in the last day, with the domain's DNS, address and registration	issued.live
Domains hosted on an IP address or range, and the certificates issued for them	issued.live (paid plans)

issued.live is this site, and we run it. Prices and free limits below come from each vendor's own pages, checked on 31 October 2026. Where a vendor publishes no price, the table says so.

crt.sh in 2026: 502 errors and a rebuild

crt.sh is run by Sectigo. It needs no account and charges nothing. It searches by name, by SHA-1 or SHA-256 fingerprint and by crt.sh ID, and its advanced search adds CN, SAN, serial and key-ID searches, an option to hide expired certificates, precertificate de-duplication and certificate linting.

The service has struggled through 2026. Users reported 502 errors on the crt.sh mailing list in March, port 5432 timeouts in April, and in May a thread titled with "502 errors for almost a month". On 28 May 2026 Sectigo wrote that it was "painfully aware that crt.sh:443 and crt.sh:5432 have been struggling for some time", put the cause on an indexing strategy that "has not aged well", and described a rebuild of the 68 TB database on PostgreSQL 15 with partitioning. No completion date was given. A user asked for an update on 11 October; the thread had no reply on 31 October.

Our own tests on 1 November 2026, around 01:20 UTC: of four JSON requests (?output=json), three returned HTTP 502 and one returned after six seconds, and plain HTML searches took 21 to 29 seconds. Five minutes later, none of six requests succeeded. A JSON search for github.com timed out after 60 seconds with no data, and the other five returned HTTP 502 within half a second, including the page for a single certificate (?id=1).

When crt.sh does answer, three habits keep queries small: tick "Exclude expired" in the advanced search, de-duplicate precertificates, and search one exact name before a % wildcard. Sectigo also names crt.sh:5432 as a public PostgreSQL endpoint for direct SQL.

Certificate transparency search tools that no longer exist

Older "crt.sh alternative" lists still recommend tools that have closed:

Google Transparency Report certificate search: discontinued in May 2022, per Google's own changelog for the report.
Meta (Facebook) Certificate Transparency Monitoring: developers.facebook.com/tools/ct/ and its documentation pages returned HTTP 404 on 31 October 2026. Meta has published no retirement date that we could find.
Entrust CT search: ui.ctsearch.entrust.com no longer resolves. Entrust sold its public certificate business to Sectigo in January 2025.
Cloudflare Merkle Town: ct.cloudflare.com now redirects to Cloudflare Radar's certificate transparency page, which shows issuance statistics and has no per-domain search.

SSLMate Cert Spotter

Cert Spotter is the closest match to crt.sh for scripts. Its CT Search API takes a domain and returns its certificates as JSON:

curl -sS "https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names"

Free: 100 single-hostname queries an hour and 10 full-domain queries an hour. SSLMate's documentation allows unauthenticated queries for personal and evaluation use.
Paid: CT Search API Medium $50 a month, Large $500 a month, and a full firehose at $1,000 a month.
Monitoring: from $15 a month (Hobbyist, 20 endpoints), with a 30-day trial. The open-source certspotter monitor on GitHub runs on your own machine at no cost.
Limits: the API returns unexpired certificates only, and searches by domain only. There is no search by IP address, public key or issuer.

Censys

Censys combines certificate data with internet-wide scans, so it answers which hosts present a certificate as well as which names it covers.

Free: 100 credits a month with an account. A search, a lookup, an extra results page or a filter each cost one credit.
Paid: no published price. Every paid tier is "Contact sales". Censys lists data history of 1+ month, 3+ months and 12+ months by tier.

Merklemap

Merklemap indexes certificate transparency for subdomain discovery. Its search supports wildcards and a Levenshtein "distance" mode that finds names a few characters away from the query, which suits lookalike-domain hunting. It also sells a live stream of newly seen hostnames.

Price: one plan at EUR 49 a month with 100,000 requests, covering the API and the website.
Free: the API requires the paid plan. Free website limits and history depth are not published.

Shodan

Shodan sees certificates by scanning hosts and reading the certificate each one serves, and exposes them under ssl.cert search filters. A certificate that was issued but never deployed on a scanned address does not appear, so Shodan shows where a certificate is in use.

Price: Membership is a one-time $49. API plans start at $69 a month (Freelancer), then $359 and $1,099.

issued.live

issued.live reads every public CT log continuously and joins each certificate to the domain's DNS from seven resolver vantage points, its hosting address and network, and its registration data from ICANN zone files. The free lookup needs no account or key and returns JSON to curl:

curl -sS https://issued.live/github.com

The response carries the current certificate ID, issuer and expiry, the hosting address, registration and expiry dates, and when a certificate for the name was first seen in CT. The same URL returns Markdown with .md appended, and a web page in a browser. Free use is 1,000 requests a day per address. https://issued.live/api/feed streams certificates as they are logged, over a rolling 30-minute window, also without a key.

Paid plans add search by address, certificate, key and name pattern:

Plus, $99 a month: reverse IP and CIDR lookup (every domain hosted on an address or range), certificate lookup by ID or SHA-256 with its full SAN list, and every certificate sharing one public key (SPKI) among certificates first seen in the last 32 hours. How the range lookup works is in find domains in an IP range.
Pro, $199 a month: pattern search across all registrable domains (*agent.com, loop-*.com), batch lookup of 500 domains in one call, the newly registered domains feed, and every certificate issued for the hostnames seen on one IP address.
Every keyed endpoint is also a tool on the issued.live MCP server at https://issued.live/mcp, on the same plan, for AI assistants.

Domains hosted on an IP address

Threat researchers pivot from one domain to its server, then from the server to every other domain hosted there. A certificate records the names it covers and nothing about where they are hosted, so crt.sh, Cert Spotter and Merklemap have no IP search.

Censys and Shodan scan IP addresses and show what each one serves at scan time, including the names on the certificate it presents.
issued.live resolves every name it sees in CT logs and zone files from its own resolvers and keeps each address a name answered with, with no expiry. The reverse IP lookup on Plus returns every domain hosted on an address, with first-seen and last-seen dates. Observations begin in August 2026.

curl -sS https://issued.live/api/v1/ip/185.199.108.133 \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

first_seen_from and first_seen_to restrict the list to domains first seen on the address inside a time window, such as the names that moved onto a server this week. /api/v1/range/{cidr} runs the same lookup across up to 256 addresses, covered in find domains in an IP range. On Pro, /api/v1/ip/{ip}/certs returns every certificate issued for the hostnames seen on the address, in issuance order.

SSL certificate history for a domain

Certificate history is where the tools differ most:

crt.sh holds the largest dataset of the free tools, a 68 TB database by Sectigo's count, subject to the availability problems above.
Cert Spotter returns unexpired certificates only, so it shows what is valid today.
Censys keeps 1 to 12+ months of data depending on the paid tier.
issued.live keeps certificates queryable for 32 hours. Pro searches the permanent archive from 9 September 2026 onward, and the daily certificate files are archived permanently from 17 September 2026. For a domain's certificates from before September 2026, use crt.sh.

Prices and free limits

Tool	Free tier	Paid from	Search by
crt.sh	No account; no published rate limit	No paid tier	Name, fingerprint, ID, CN, SAN, serial, key ID
Cert Spotter	100 hostname queries/hour, 10 full-domain/hour	$50/month (API), $15/month (monitoring)	Domain
Censys	100 credits/month, account required	Not published	Certificates, hosts
Merklemap	Website only; limits not published	EUR 49/month	Domain, wildcard, edit distance
Shodan	Account; filter access not documented	$49 once, API $69/month	Hosts, certificate fields
issued.live	1,000 requests/day, no account	$39/month; searches from $99/month	Domain, IP, CIDR, certificate, public key, name pattern

Sources: crt.sh, the crt.sh mailing list, SSLMate CT Search API, Cert Spotter pricing, Censys free credits, Censys pricing, Merklemap pricing, Shodan plans, Google Transparency Report changelog, and issued.live pricing. Prices change; check the vendor before buying.

For bulk domain lists and zone files, the issued.live comparison page covers AllZonefiles.io, Domains-Monitor and WhoisXML API.

3D-printable QR duck tags for multi-color printers

Daniel J — Sat, 31 Oct 2026 15:23:16 +0000

Every DuckyTrack duck can now get a 3D-printable QR tag. A Duckster asked for a way to build their duck's tag into the ducks they print, so we made a two-color model you download from your tag's page and print on a multi-color printer. Fresh off the build plate, it works like any DuckyTrack tag: scan it and the duck's journey opens.

What you download

A 3MF model with two parts. "Tag base" prints in light filament and "QR code" prints in dark filament. White and black scan best.
The same two parts as STL files, packed in a ZIP.
Two styles. A hang tag with a keyring hole that fits a split ring or cord, or a square inlay to build into your own duck designs.
Three sizes: 30, 40 and 50 mm. We recommend 40 mm for reliable scans.

Printers and slicers

The model is made for multi-color printers, such as a Bambu Lab printer with an AMS, or a Prusa printer with an MMU or XL toolheads. It opens in Bambu Studio, OrcaSlicer and PrusaSlicer. If your slicer asks whether to load the file as a single object with multiple parts, choose Yes.

Why it prints face-down

The QR code is inlaid flush with the base and prints face-down on the build plate. Printing the code on the first layers gives it crisp edges and a matte finish that phone cameras read well. All the color changes happen in those first few layers, so the print is fast and purges little filament.

Print the tag exactly as it is placed. Flip it over when it comes off the plate and the code reads correctly.

Scan the printed tag with your phone before you release the duck. Scan it outside the DuckyTrack app and close the page without tapping "I found it!", so the test logs no find.

How to get yours

Create your duck's tag at /tags. Tags are still free.
On that tag's download page, find the "3D-Printable Tag" card.
Pick a style and a size, then tap "Download 3D Model (3MF)", or take the STL files in a ZIP.

The 3D tag follows the same rules as our paper QR duck tags: only the duck's owner can download it, from the download page, within 72 hours of creating the duck.

Hatching next: printable ducks with your code built in

The tag is step one. We're building a collection of 3D-printable duck designs with the owner's QR code already built in. Download one, drop it into your slicer, and print a finished duck that is ready to track.

Designs in the works include pocket-size ducks made for hiding, tabletop display ducks for businesses and vacation rentals, and a few surprises. The collection launches as a beta first.

Printer owners, send us the ducks you'd like to print through our contact page.

EtherSnake: a zero-detection MSI that hides its C2 on Ethereum

Daniel J — Thu, 29 Oct 2026 22:20:43 +0000

Updated October 30, 2026: the analyzed samples are now on MalwareBazaar, and we added netpatch.msi, a possible earlier variant. The details are in the update near the end of this post.

EtherSnake is a Windows installer that scored 0 detections on VirusTotal and installs a Python backdoor that reads its command-and-control (C2) address from an Ethereum smart contract. The operator has set that address seven times since deploying the contract on October 16, an initial value and six changes, and every infected machine follows each change. Snoopy Triage, Tuxxin's threat analysis platform, extracted every stage and decrypted the payload on October 29, 2026 without running it.

How the sample surfaced

On October 29, 2026, @malwrhunterteam posted the sample, served from Azure hosting at hxxps://octoberfp.eastus.cloudapp.azure[.]com/files/KB59985. VirusTotal showed 0 detections, and its Code Insight summary said the MSI had "no active components, scripts, or installation routines". @smica83 uploaded it to MalwareBazaar. Snoopy Triage picked it up from a public feed.

The infection chain

1. The MSI

The installer is 36 KB, built with WiX on October 28 at 14:45 UTC, with random product and manufacturer names. It unpacks four files into a random folder under %LOCALAPPDATA%:

DeployFinalize.cmd
a two-line VBS helper
a Python loader
an encrypted .bin file

A deferred, asynchronous custom action runs DeployFinalize.cmd after the install finishes. A hidden shortcut in the Startup folder runs it again at every logon.

2. DeployFinalize.cmd

The script is padded with fake corporate-deployment comments. It downloads the official embeddable Python 3.12.3 from python.org, with the URL stored in base64, and unpacks it with the Windows tar.exe. It renames pythonw.exe to ConfigEngine.exe and starts it hidden through the VBS helper.

Each file a scanner sees on its own is either legitimate software or meaningless data. That explains the zero detection score.

3. The loader

The Python loader XORs the .bin file with a 32-byte key and each byte's position, then passes the result to exec(), so the decrypted backdoor runs in memory.

4. The backdoor

The backdoor is written in Python and carries code paths for both Windows and Linux.

It reads its C2 address from an Ethereum smart contract. It asks nine public RPC providers and takes the majority answer. The lookup key is the operator's wallet address.
It polls /api/<random>/<bot id>/<random>.png?id=<build id>, or the same path ending in .jpg, .gif, .css, .ico or .webp, and sends the header X-Bot-Type: python.
It runs any Python code the server returns, with shell and socket access.
It persists through a Startup file named MicrosoftEdgeUpdate.cmd and a logon task named MicrosoftEdgeUpdateTask followed by four hex characters.
It disables TLS certificate checks.

The C2 lives on Ethereum

The contract is 0x41179162599919ad4eadcabc2cfefc1133269c2c on Ethereum mainnet. The operator wallet, 0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06, has 8 transactions: the contract deployment and 7 writes of the C2 address. The first write set the initial C2 three blocks after deployment, and the other 6 changed it.

The operator can move the C2 at any moment with one transaction, and every bot follows. The same design gives defenders a full public record: every C2 the operator ever set is readable on-chain.

#	UTC	C2 written to the contract	Note
1	2026-10-16 20:37	`hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com`	Initial value, just after deployment
2	2026-10-27 22:10	`hxxps://sigmauperdonesoft[.]com`
3	2026-10-28 06:54	`hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com`
4	2026-10-28 09:53	`hxxps://sigmauperdonesoft[.]com`
5	2026-10-28 10:04	`hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com`
6	2026-10-28 10:57	`hxxps://westusserverfor.westus2.cloudapp.azure[.]com`
7	2026-10-29 14:13	`hxxps://esastus-oct29.eastus.cloudapp.azure[.]com`	Current

The sample also carries a built-in backup C2, october28floor.eastus.cloudapp.azure[.]com. The last switch came about 4.5 hours before the public post.

sigmauperdonesoft[.]com was registered on October 27 and pointed at 172.233.158[.]8 (Linode), with Cloudflare DNS. softportalone[.]com was registered the same day and shares that IP. We found no evidence it served as a C2.

Every host in this campaign was created by the attacker. No compromised websites are involved.

Why the name EtherSnake

The design mirrors EtherRAT, a Node.js implant Sysdig documented in December 2025: C2 stored on-chain, a majority vote across nine RPC providers, the wallet as the lookup key, and a download of an official language runtime. We found no shared code and make no attribution claim. "EtherSnake" names this Python implant only.

Indicators

Cloud IPs get reassigned quickly, so the hostnames and hashes are the lasting indicators.

SHA256

Hash	File
`a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0`	MSI
`3aaaa49a0c4b139a8098b27dba31235571f68b32d96e25669e7febe6c82976d9`	DeployFinalize.cmd
`61d6b309d9774d13d632322816260e082f96293087333e7a379310e7b0796be0`	VBS helper
`905e2e48e90e0d4aa332e7c39e9d7a41407fdc5bc78bad14c46294ec5c08b784`	Python loader
`d79112cd7e8107719c63f901896f74154d5cf3d8aa20937c4ecb2f56ae28db46`	Encrypted .bin
`a0501b667a166efa07bfa4f376d24e97948c68661a13e37ce6a6029edcbee0aa`	Decrypted backdoor

Hosts and IPs

Host	IP	Role
`octoberfp.eastus.cloudapp.azure[.]com`	`172.174.116[.]94`	Payload host
`zone-14-service-8-8.eastus.cloudapp.azure[.]com`	`4.246.227[.]107`	C2
`sigmauperdonesoft[.]com`	`172.233.158[.]8`	C2
`westusserverfor.westus2.cloudapp.azure[.]com`	`20.94.232[.]24`	C2
`esastus-oct29.eastus.cloudapp.azure[.]com`	`20.55.89[.]207`	C2 (current)
`october28floor.eastus.cloudapp.azure[.]com`	`172.174.235[.]40`	Backup C2
`softportalone[.]com`	`172.233.158[.]8`	Sibling domain

On-chain

Contract: 0x41179162599919ad4eadcabc2cfefc1133269c2c (Ethereum mainnet)
Operator wallet: 0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06

Detection

pythonw.exe, or any process named ConfigEngine.exe, connecting to public Ethereum RPC providers.
The header X-Bot-Type: python in proxy or web server logs.
Logon tasks named MicrosoftEdgeUpdateTask plus hex characters that point to a Python runtime under %LOCALAPPDATA%, and a Startup file named MicrosoftEdgeUpdate.cmd.
An MSI custom action that runs a .cmd file from its own install folder.

On an infected host: isolate it, remove the logon task, the Startup files and the %LOCALAPPDATA% folder, and treat every credential used on that machine as exposed.

Update, October 30, 2026

Samples on MalwareBazaar

The four files we analyzed are now public on MalwareBazaar with the tag EtherSnake, next to the MSI that @smica83 reported. The links are in the list at the end of this post. The decrypted backdoor is the payload decrypted from Ac2cwRJF6zPS.bin; on a victim it only ever runs in memory.

A possible earlier variant: netpatch.msi

netpatch.msi is a 32 KB WiX MSI with the product name "FactAuth", built on October 27, 2026. @smica83 posted it on MalwareBazaar on October 29, and @malwrhunterteam shared it the same day. It was hosted on Azure blob storage at buildpoint.blob.core.windows[.]net/stackguard/netpatch.msi, and the file has since been removed.

The link to EtherSnake rests on design overlap alone. The two share no wallet, server or code, so we call netpatch a possible earlier variant and nothing stronger.

How netpatch works

A custom action runs ins.cmd. It downloads the official embeddable Python 3.14.3 from python.org into a random nine-letter folder under %LOCALAPPDATA%, installs pip, and pip-installs web3, pywin32, pythonnet, pywinpty and websockets.
get_message.py uses web3 to call getMessage() on an Ethereum Sepolia testnet contract, 0x86bdF9F8D5fD58C53018a7C797Bd50d4ca6C1A1f, and writes the answer, the C2 host, to ML.txt.
A one-line pythonw.exe command, with its strings split apart, polls https://<C2>/<6 random letters>/<9 random letters>?v=6 with certificate checks off. It runs the Python code in the c field of the JSON reply.
start.cmd repeats this at every logon.

The contract's current C2 is deployment.eastus.cloudapp.azure[.]com (20.55.80[.]190), written on September 22, 2026.

netpatch on-chain history

The deployer wallet, 0x378ba15a67666137D8158b4EfaBF71B3EAfdDeCB, was funded with test ETH on June 21, 2026. In June it built and tested a two-way message channel on Sepolia: a contract named MessageQueue with sendToServer, sendToClient and clearServerMessages calls.

On September 20, 2026 the wallet deployed the netpatch contract and wrote "Hello from Python!" to it as a test. On September 22 it wrote the Azure C2.

Why it may be related

Both are small WiX MSIs.
Both stage the official python.org embeddable runtime in a random %LOCALAPPDATA% folder.
Both read their C2 host from an Ethereum contract.
Both use Azure East US cloudapp hosts for C2.
Both run whatever Python the C2 returns, with TLS verification off.
Both surfaced the same week.

The netpatch contract predates EtherSnake's first contract, deployed October 16. netpatch looks like a simpler build: a testnet instead of mainnet, one RPC provider instead of a nine-provider vote, and no encrypted stage.

What we can't show

No wallet, server or code is shared with EtherSnake.
The Sepolia wallets have never been used on mainnet, and the EtherSnake wallets have never been used on Sepolia.
Blockchain-hosted C2 is common enough that a separate actor is possible.

netpatch indicators

Type	Value	Note
SHA256	`acd083343625712a2116d2480cdf9e80af72338b7653590d03b109b60708742b`	netpatch.msi
SHA256	`64ac14cde7dc19a6f57ec14ddeb9f4404c559968472080a8bc5644dc067858b9`	ins.cmd
SHA256	`85b4a507984b89be7378a64affb762712b25544a00b18d0b187d7816519490a6`	start.cmd
SHA256	`c0fdefe243f17f89b1b4b2dd93574b52b3509c87a80123209222a6724a77e047`	get_message.py
Sepolia contract	`0x86bdF9F8D5fD58C53018a7C797Bd50d4ca6C1A1f`	`getMessage()` returns the C2
Sepolia wallet	`0x378ba15a67666137D8158b4EfaBF71B3EAfdDeCB`	Deployer and writer
Host	`buildpoint.blob.core.windows[.]net`	Payload host
Host	`deployment.eastus.cloudapp.azure[.]com`	C2, `20.55.80[.]190`

Detecting netpatch

Endpoints that run pip or web3 from a Python folder under %LOCALAPPDATA%.
A file named ML.txt next to pythonw.exe in that folder.

Shared publicly

AlienVault OTX pulse with 33 indicators, including netpatch
URLhaus: the payload URL
ThreatFox: 5 C2 hosts tagged EtherSnake
MalwareBazaar, tagged EtherSnake:
- The MSI, reported by @smica83
- DeployFinalize.cmd
- run1w7zzg.vbs, the VBS helper
- xBoInRMFWK.py, the XOR loader
- The decrypted backdoor stage, decrypted from Ac2cwRJF6zPS.bin; on a victim it only ever runs in memory

Thanks to @malwrhunterteam for spotting and posting the sample, and to @smica83 for sharing it on MalwareBazaar. Analysis by Snoopy Triage.

Docker UFW bypass: why ufw status says closed but the port is open

Daniel J — Thu, 29 Oct 2026 14:19:02 +0000

A port published with docker run -p 8080:80 is reachable from the internet even when ufw status shows no rule allowing it. Docker writes its own iptables rules, and traffic to a published port is forwarded to the container before it reaches the rules UFW manages. This guide shows the mechanism, how to see it on the host, how to confirm it from outside, and five ways to fix it, safest first. The facts below were checked against the Docker Engine 29 documentation (29.9.2 is the current release) in October 2026.

Why Docker bypasses UFW

UFW keeps its rules in the iptables INPUT chain, which handles traffic addressed to the host itself. When you publish a port, Docker adds two kinds of rules of its own:

In the nat table, PREROUTING jumps to Docker's DOCKER chain, which rewrites the destination (DNAT) from the host's port 8080 to the container's address and port 80.
In the filter table, the FORWARD chain jumps to Docker's chains, DOCKER-USER and DOCKER-FORWARD, which then accept the forwarded traffic.

Because the destination is rewritten in PREROUTING, the packet is routed to the container and travels through FORWARD. Docker's documentation puts it directly: packets are diverted before they reach the INPUT and OUTPUT chains that ufw uses. A ufw deny 8080 rule sits in a chain this traffic never visits, so ufw status looks correct while the port answers the whole internet.

Two defaults widen the exposure:

-p 8080:80 with no host address binds every host address, 0.0.0.0 and [::].
IPv6 rules (ip6tables) have been on by default since Docker 27.0, and with the default userland proxy, the host's IPv6 addresses forward to the container even when the container network is IPv4-only.

Older guides mention DOCKER-ISOLATION-STAGE-1 and -2. Docker 29.0 removed those chains, and Docker 28.0.1 moved most of its forwarding rules into DOCKER-FORWARD.

See it on the host

Start with what Docker has published. The PORTS column shows the bind address: 0.0.0.0:8080->80/tcp and [::]:8080->80/tcp mean every interface.

docker ps --format 'table {{.Names}}\t{{.Ports}}'

List listening sockets. With the userland proxy, which is on by default, each published port shows a docker-proxy process:

sudo ss -tlnp

Show the port mappings in the nat table and any filtering you have added in DOCKER-USER:

sudo iptables -t nat -L DOCKER -n
sudo iptables -L DOCKER-USER -n -v
sudo ip6tables -t nat -L DOCKER -n

An empty DOCKER-USER chain means nothing filters traffic to your published ports. Compare this with sudo ufw status verbose: a port can appear in the DOCKER chain with no matching UFW rule.

If you run Docker with the experimental nftables backend ("firewall-backend": "nftables", added in 29.0), the iptables commands show nothing useful. Use sudo nft list ruleset instead.

Check it from outside

The host's own view tells you what should be open. Only a scan from another network shows what is. From the server you want to check, run:

curl -4 qsa.sh

qsa.sh scans only the public IP the request comes from, and it has no way to target any other address. Before anything is sent, it prints the detected IP and starts a 15-second countdown. Ctrl-C cancels. The free scan checks the top 1,000 TCP ports with naabu 2.7.0, fingerprints each open service with nmap 7.993 and the vulners script, runs about 2,000 curated nuclei 3.11.1 checks, and streams the results live. It allows one scan per IP per 24 hours, and results are not stored.

Know the limits before you trust a clean result:

A container on an unusual high port can sit outside the top 1,000. The Full tier ($5/month) scans all 65,535 TCP ports, with results in roughly 2 to 12 minutes. See pricing and how it works.
IPv6 callers are refused for now, which is why the command uses curl -4. Check IPv6 exposure with nmap from another machine.
CGNAT, mobile carrier, proxy, VPN and Tor exits are refused, so run it from the server itself.

All three tools are open source, and you can run them yourself. From a machine on a different network:

nmap -Pn -p- YOUR_SERVER_IP
nmap -6 -Pn -p- YOUR_SERVER_IPV6

Fix it, safest option first

1. Bind published ports to loopback

If only a reverse proxy on the same host needs the container, publish it on 127.0.0.1, and on [::1] if you need IPv6 locally:

docker run -d -p 127.0.0.1:8080:80 nginx

In Compose:

services:
  app:
    image: nginx
    ports:
      - "127.0.0.1:8080:80"

Put your reverse proxy (nginx, Caddy, Traefik) in front and expose only 80 and 443. Run a current Docker Engine: before 28.0.0, hosts on the same L2 segment could reach ports published to localhost, and 28.3.3 fixed CVE-2025-54388, where a firewalld reload could expose loopback-only ports to the LAN.

To change the default for containers that leave out the host address, set "ip": "127.0.0.1" in /etc/docker/daemon.json for the default bridge, or the com.docker.network.bridge.host_binding_ipv4 option on a user-defined network.

2. Publish nothing; use a shared network

Containers on the same user-defined network reach each other by name with no published ports. Only the proxy publishes anything:

services:
  proxy:
    image: caddy
    ports:
      - "80:80"
      - "443:443"
    networks: [web]
  app:
    image: nginx
    networks: [web]
networks:
  web: {}

The proxy forwards to http://app:80, and the app has no host port for anyone to reach.

3. Filter in the DOCKER-USER chain

Docker reserves DOCKER-USER for your rules, and FORWARD jumps to it before Docker's own chains. Packets here have already been rewritten, so a plain --dport match sees the container's port. Match the original destination with conntrack. The rule that keeps established connections working has to come before any DROP, and -I inserts at the top, so add it last:

# Drop internet traffic to the published host port 8080 (eth0 is the public interface)
sudo iptables -I DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 8080 -j DROP

# Or: allow only one admin network to reach any published port
sudo iptables -I DOCKER-USER -i eth0 ! -s 192.0.2.0/24 -j DROP

# Then keep replies to existing connections flowing (inserted last, so it runs first)
sudo iptables -I DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Repeat the rules with ip6tables for IPv6. Rules added this way are lost on reboot unless you save them with your distribution's persistence tool, such as netfilter-persistent. Docker's documentation notes that conntrack matching can cost some performance. The nftables backend has no DOCKER-USER chain; its documentation describes putting your rules in your own table with a base chain on the forward hook.

4. Use ufw-docker

The third-party ufw-docker project adds a DOCKER-USER block to /etc/ufw/after.rules (and after6.rules) that sends container traffic through UFW's forward rules. You then open container ports with route rules:

sudo ufw-docker install
sudo systemctl restart ufw
sudo ufw route allow proto tcp from any to any port 80

It keeps everything in UFW and survives reboots. It depends on DOCKER-USER, so it cannot work with the nftables backend, and it has open issues about Docker 28 and 29 chain changes. Test the result from outside after installing it.

5. Disable Docker's iptables management (last resort)

Setting "iptables": false in daemon.json stops Docker writing rules. Docker's documentation warns that this is likely to break container networking: containers lose outbound internet access through masquerading, and, with no replacement rules, all container ports are reachable from hosts on the local network. You would have to write the NAT and forwarding rules yourself. Use one of the options above unless you are prepared to do that.

firewalld and other hosts

The same bypass applies to firewalld. Docker creates a firewalld zone named docker with target ACCEPT for its bridges, and a docker-forwarding policy that allows forwarding from any zone to it, so rules on your public zone do not filter published ports. Bind to loopback or filter in DOCKER-USER, exactly as above.

Re-check from outside

After the fix, scan again from outside and confirm the port is gone. The free qsa.sh scan allows one run per IP per 24 hours, so for a same-day re-check use nmap from another machine, or a Full token. To catch a new -p flag the next time someone deploys, run a scheduled scan yourself: qsa.sh sends no alerts and runs no monitoring, and this cron script compares each scan with the last one. If you are wary of piping curl output anywhere, this post explains why curl qsa.sh only prints text.

FAQ

Does UFW block Docker published ports?

No. UFW filters the INPUT chain, and Docker forwards published-port traffic through FORWARD after rewriting its destination in the nat table.

Why does ufw status say the port is closed?

ufw status lists UFW's own rules. Docker's DNAT and forwarding rules live in separate chains that UFW does not report.

Is binding to 127.0.0.1 enough?

On Docker Engine 28.3.3 or later, yes for internet exposure. Older releases let hosts on the same L2 network reach localhost-published ports.

Does this affect IPv6?

Yes. Unbound ports listen on [::], and ip6tables is on by default. qsa.sh does not scan IPv6 yet, so check it with nmap -6 from another network.

Does the free scan cover every port?

It covers the top 1,000 TCP ports. The Full tier scans all 65,535.

Free URL scanner: check a link before you open it

Daniel J — Wed, 28 Oct 2026 14:13:04 +0000

The whack.sh URL scanner is free to use, with no account needed. Paste a suspicious link, and our browser opens it once in a fresh, isolated Chromium browser on our datacenter network. You get a report on the page without ever opening it yourself.

A quick human check (Cloudflare Turnstile) runs before each scan. Scan a link now, or open the example report to see what you get back.

What the report shows

Every report includes:

A verdict
A risk score from 0 to 100
The top 3 signals behind the verdict
Every redirect from the link to the final page

Without an account, you can run 5 scans per hour from one browser and network, on pages up to 25 MB. These scans come without a screenshot. Each scan gets a private report link that works for 7 days, and anyone with the link can open it.

More with a free account

A free account raises the limit to 10 datacenter scans per hour, with any page size. It adds a screenshot of every page and the full report: every signal, the request log, and HAR and IOC export. Captures are kept for 30 days, and the account includes API access.

Paid plans add residential and mobile vantage points, with a side-by-side comparison of what each one received. They are billed in credits.

What a clean result means

Some malicious sites show scanners and datacenter visitors a harmless page, then send home and mobile visitors to the attack. This is called cloaking. A clean result means our datacenter browser saw nothing harmful. A visitor on a home or mobile connection can still receive a different page.

The multi-source scanner loads the same link through datacenter, residential and mobile connections and compares the results.

The site also sees the visit. Our browser loads the page once from a datacenter IP address. If the link is a tracking link from an email, the scan tells the sender the email was opened.

Privacy and fair use

Scans run without an account are never contributed or sold. After 7 days the report is deleted, unless the scan is under an abuse or legal hold. Our privacy policy has the details.

Scan links you received or plan to visit. Do not use the scanner to test or attack sites. The free scanner may pause during heavy use, and it is not available in a few regions.

Check a link before you open it.

Empire War adds Office Tower, Trade Route and new artwork

Daniel J — Tue, 27 Oct 2026 14:13:01 +0000

Empire War, Tuxxin's free browser tycoon game, shipped five updates this week, versions 1.20 to 1.24, between October 22 and 26, 2026. Two new side games lead the list: Office Tower, where you build and staff your company's headquarters, and Trade Route, a 30-day commodity trading run. Around them, every division, deal and collectible got new artwork, the IPO Center was rebuilt, player profiles were redesigned, a Temp Agency now speeds up deal cooldowns, and the menus got easier to find your way around.

Empire War is an idle business game played in the browser. You close deals for cash and XP, run divisions across six industries for passive income, hire and manage employees, launch hostile takeovers against real players, keep your SEC Heat under control, and take the company public through an IPO for permanent prestige bonuses. There is no download, no app store and no pay-to-win.

New side game: Office Tower

Office Tower, launched October 24 in v1.23, is an office builder inside the game. Your headquarters has six rooms, and each one powers up a different part of your empire:

Server Room: more division income.
Sales Floor: higher deal success.
Legal Dept: less SEC Heat.
Gym: faster AP recharge.
Security Office: stronger PvP attack and defense.
Cafeteria: lower salaries.

Rooms level up as high as your CEO level. Early levels build in minutes, while big upgrades take days or even weeks, and you have two builders, so there is always something under construction. Perks grow with every level. At full morale they approach +30% income, +15% deal success, 60% less Heat, 30% faster AP, +40% PvP power and 30% lower salaries.

Your staff need desks. The office seats 5 to start, and every room level adds 2 more. Your staff cap is the lower of your desks and your CEO-level cap. The office unlocks when you reach 5 employees, with a "Your business is growing, time to get office space" moment. Existing players received free room levels, so nobody lost staff capacity.

Team morale runs from 0 to 100. It drops a little every hour and scales every room perk between 50% and 100%. Pizza Parties, Team Lunches and Year-End Bonuses raise it, and a Late-Night Push spends morale for a burst of cash and XP. Prices scale with your own income, so building is worth it at any level, and your office survives an IPO.

New side game: Trade Route

Trade Route, launched October 26 in v1.24, is a trading game inspired by classics like Drug Wars. Each run lasts 30 days. You start with $2,000 and a $5,500 loan from a venture capitalist, and the loan grows 10% a day.

You trade 7 commodities, from coffee at around $10 to gold at around $30,000, across 6 world markets: New York, London, Dubai, Tokyo, Shanghai and Sao Paulo. Each market sells some goods cheap and pays well for others:

Dubai: oil
Tokyo: microchips
Sao Paulo: coffee
London: gold
Shanghai: steel and lithium
New York: pharmaceuticals

Prices change every day, and some goods sell out. Sailing between markets takes a day, and trouble finds you on the way: customs stops where you pay up or risk losing half your cargo, pirates, storms, offers of extra cargo space, abandoned containers, and sudden crashes and shortages.

You can repay the loan by wire from any port, and borrow more in person in New York. A run costs 20 AP, and you can cash out at any time. Your score is your cash minus the loan.

Beat your starting cash and you earn real cash and XP for your main company, worth up to 4 hours of your division income, on your first 3 runs each day. Every run counts toward the weekly and all-time Trade Route leaderboards.

A full visual overhaul

Versions 1.20 to 1.22 redrew the game. Each of the 90 divisions, all 31 deals and all 40 collectible loot items has its own icon. Employee titles and specialties, deal tiers and achievement categories have icons too.

Color now carries meaning. Each of the six industries has its own color: Technology blue, Energy yellow, Media purple, Finance green, Real Estate orange and Retail pink. Collectibles are framed in their rarity color, from gray Common to gold Legendary.

Illustrated banners now open the HQ, Deals, Divisions, Staff, PvP, Collections, Achievements, IPO Center, Power 500 and Missions pages, with the page title laid over the art, and each industry in the division shop has its own banner.

Closing a deal feels like a payday. A payout card shows the deal's icon while your cash and XP count up, loot drops appear as a card in their rarity color, and level-ups get their own banner.

Progress is visible everywhere. Bars fill as deal cooldowns and division upgrades run, each division shows a 10-step level meter, and the top bar shows your XP progress and your SEC Heat shifting from green to red.

A redesigned IPO Center

The IPO Center, rebuilt in v1.22, lays out a clear four-step road to going public: reach Level 25, complete 3 IPO Preparations, wait out a 24-hour Quiet Period, then Go Public.

The IPO Preparation deal shows its cost, reward and progress, with a live cooldown countdown. A new "If you went public now" panel estimates your exit valuation, your starting cash and your weekly dividends.

Redesigned player profiles

Every player profile has been rebuilt. It opens with an industry-art banner carrying the company crest, the CEO level and achievement rings, and the player's PvP win rate.

Below that are lifetime career stats:

login streak;
deals closed and deal success rate;
missions completed;
Guess the Bigger Company win rate;
Office Tower levels;
Trade Route runs and best score.

The profile also breaks down the empire by industry and shows recent achievements, collection badges and an IPO timeline. You can open any player's profile from the Power 500.

New: the Temp Agency

The Temp Agency, launched October 26, sits on the Deals page. Once a day you can hire temps who instantly cut time off every deal on cooldown:

Intern Pool: 15 minutes.
Contract Closers: 1 hour.
Consulting Team: 3 hours.
Executive Temps: 8 hours.

Prices scale with your income. It is a handy shortcut for squeezing in the last deals before a level-up.

Easier to find, plus smaller fixes

Both side games live under Missions in the menu and in a new "Side games" panel on your HQ.
The Deals page remembers which tier you were on.
Collections show how many spare copies you can scrap.

The full details are in the patch notes, and the How to Play guide has complete sections on Office Tower and Trade Route. Questions are answered in the FAQ, and the Power 500 leaderboard shows who is on top right now.

Play free at empirewar.co

Empire War is free to play in your browser, with no download and no pay-to-win. Build your first office, run your first trade route and start climbing the Power 500. Play free at empirewar.co.

The Week Eye is live: a free stereogram puzzle every Monday

Daniel J — Mon, 26 Oct 2026 23:05:59 +0000

The Week Eye is a free weekly puzzle built on stereograms: flat patterns of colored dots that hide a 3D word or shape. A new image goes live every Monday at 8:00 a.m. Eastern. Find the hidden answer, type it, and the server times your solve. The first puzzle, week 44, is live now and closes Monday, November 2 at 8:00 a.m. Eastern.

The easiest practice image from the lessons. A large square floats in front of the pattern.

How to play

Press Start, and the clock begins when the image appears. Bring your face close to the screen so the image blurs, look through it as if at something far behind it, then lean back slowly. When the two dots above the image become three, your eyes are set and the answer rises out of the pattern. Type it and press Check.

On a phone, turn it sideways to see the image full screen, then turn it back upright to type. Anyone can play without an account. To get your time on the leaderboard, sign in before you start. Sign-in takes an email address and a 6-digit code, with no password.

Leaderboards and streaks

The weekly board ranks solves by fewest guesses, then fastest time, and updates with every solve. Last week's board is final once the new puzzle drops. The all-time board ranks the longest current streaks, counted in weeks solved in a row, with badges at 4, 12, 26 and 52 weeks. Solves under 4 seconds are listed but stay unranked until they are reviewed.

Learn to see it

The lessons walk through six practice images, from a flat pattern with nothing hidden to a hard weekly level, and each one has a check so you know you saw it. The guides cover parallel and cross-eyed viewing, playing on a phone, and the usual reasons the picture will not appear.

Eye Trials

Eye Trials is a daily challenge with ten levels. Each attempt is a fresh image with one guess, and the next attempt opens 24 hours later. Every level has less depth, a busier pattern or a tilted answer than the one before, and a wrong answer sends you back to level 1. Clear all ten in one run to earn the Sharp Eye rank. Eye Trials needs a free account to save your progress.

How the images are made

Every image is generated by code, with no AI. A depth map of the answer becomes a repeating dot pattern through the linked-pixel method that Thimbleby, Inglis and Witten published in 1994. Before an image is queued, an automatic check confirms that the hidden picture is present and that the flat pattern does not reveal the answer. Each week's image comes in 20 variants, and a holiday or daily observance sets the theme.

When a week closes, its image, answer, depth map and final results move to the archive. Closed weeks make good practice because you can check what you see against the answer.

Get the puzzle by email

The weekly email arrives each Monday when the new puzzle goes live. It carries last week's answer, plus your streak if you have an account, and every email has a one-click unsubscribe link.

The Week Eye is built and run by Tuxxin in Orlando, Florida.

Hunting adversary infrastructure with issued.live and WorldIP.io

Daniel J — Mon, 26 Oct 2026 20:50:00 +0000

Hunting adversary infrastructure starts from one indicator, usually an IP address, and works outward to the operator's other servers and domains. Two Tuxxin tools cover that work. WorldIP.io enriches the address: who holds it, how it is routed and what kind of traffic leaves it. issued.live pivots from it: every hostname seen answering there and the certificates behind them. Until WorldIP.io's paid plans launch, every issued.live Plus or Pro subscription includes a free beta key to the WorldIP.io premium API.

The offer

issued.live Plus ($99 a month) includes a WorldIP.io Pro key: 200,000 enriched lookups a month with VPN, proxy, Tor and datacenter classification, a trust score and blocklist hits.
issued.live Pro ($199 a month) includes a WorldIP.io Business key: 1,000,000 enriched lookups a month, adding live BGP prefixes and MOAS conflicts, BGP anomaly events and Web3 node roles.
The key is emailed within one business day to the address on the issued.live subscription. It works through the WorldIP.io beta and for 30 days after the paid plans launch, which is planned within the next 30 days.

IOC enrichment: what the address is

An IP address from an alert carries little on its own. A WorldIP.io lookup enriches it with the organization, ASN and ASN type, regional registry ownership, city-level geolocation where it exists, the network's access type, blocklist hits, a trust score from 0 to 100 and a proxy verdict. The Business key adds routing context: whether the prefix has a multiple-origin conflict and whether it appeared in a recent BGP anomaly.

Pivoting threat intelligence: what has run at the address

issued.live turns the address into infrastructure. Its reverse IP lookup returns every hostname its resolvers have recorded answering there, with first-seen and last-seen times, and a range lookup does the same for up to 256 addresses at once. Certificate pivots return the other names on each certificate. SPKI pivots return every certificate issued for the same key pair, which reaches servers on other addresses.

A worked hunt from one IP address

Most hunts start from a firewall hit, an EDR callback or a sender address in a phishing email header. From there:

Enrich the address. The WorldIP.io profile says whether it sits on a hosting provider's range, on a home ISP or behind a proxy, and whether its route is under dispute. That decides how much weight the rest of the hunt carries.
List what runs there. An issued.live reverse IP lookup returns the hostnames with their first-seen dates. A burst of new names inside a few days is the usual sign of a fresh campaign, and one lookup mapped 532 hostnames this way.
Pivot on certificates and keys. The certificates behind those names lead to other names and, through shared public keys, to other addresses. Each new address goes back to step one.
Search the naming grammar. On Pro, pattern search matches the shape of the names, such as a short word followed by agent in .com, against every registrable domain in the corpus.

issued.live's guide to find domains in an IP range covers the range endpoint and the certificate pivots in detail.

Bug bounty reconnaissance

Certificate Transparency and reverse IP data map a target's hostnames without sending a packet to it. issued.live lists the names on the target's certificates and the hostnames that share its addresses. WorldIP.io's organization and ASN fields then show which of those addresses sit on the target's own network and which belong to a CDN or a cloud provider, which decides where the in-scope servers are.

Fraud and sign-up screening

The same WorldIP.io classification can gate a form. One lookup per sign-up returns is_proxy, is_vpn, is_tor, is_datacenter and a verdict, so a form can deny detected proxies, send datacenter traffic to review or log the verdict next to each account. WorldIP.io's guide explains how to detect residential proxies and mobile proxies with those fields.

Free threat intel API tiers

Both tools also answer without a key. WorldIP.io's keyless API returns the owner, ASN, country, reverse DNS and CIDR block for any address, plus the number of domains hosted on an IPv4 address, up to 1,000 lookups a day:

curl worldip.io/8.8.8.8

issued.live's free public record covers any domain's certificate, issuer, expiry, hosting address and current DNS, plus its registration dates and registrar, also at 1,000 requests a day per client address. The paid tiers and the beta key add the pivots and the enriched profile.

Terms

The offer covers issued.live Plus and Pro. issued.live Basic is not included.
The WorldIP.io key stays active while the issued.live subscription does.
The beta carries the monthly quotas above and has no uptime guarantee.
The WorldIP.io limits may change during the beta; key holders are emailed before any change.

Plans are on the issued.live pricing page.

Scam ads in Yahoo Mail hid a fake Microsoft support alert

Daniel J — Mon, 26 Oct 2026 20:44:37 +0000

Sponsored messages in the AT&T edition of Yahoo Mail led some readers to a fake Microsoft security alert. The alert told them to call a support number. Our visits from a data center or a phone got a dating or personal finance article instead.

William Vincent, a whack.sh customer, noticed something off about the ads and asked Tuxxin to dig further.

We traced two scam operations through the same ad slot on October 7 and 8, 2026. One of them had also used a Taboola ad on September 24.

The scam kit behind the first ad appears in 747 public scans from July 12 to October 10, the 90 days our search could reach. Those scans cover 536 cloud hostnames and 160 phone numbers.

The technical writeup on whack.sh traces both ad chains hop by hop and lists every indicator.

The ad looked like a new message

The ad sat in the inbox list like an email. Its sender line read "CHECKOUTERS" and its subject read "(1) New Message". A small "Ad" label marked it as sponsored.

The ad row in AT&T Yahoo Mail, October 2026. Screenshot by William Vincent, cropped to the ad, with personal details removed.

Taboola sells the native ads across Yahoo's sites under a 30-year agreement. Yahoo's ad space opened to Taboola advertisers worldwide in October 2023. When it announced the deal in 2022, Taboola said Yahoo reached nearly 900 million monthly users worldwide.

A click on the ad passed through Taboola's click tracker under the publisher ID "yahoo-mail-att". That is the AT&T edition of Yahoo Mail, which serves att.net, sbcglobal.net, bellsouth.net and other AT&T addresses.

In our scans, only Windows desktops on home broadband got the scam

whack.sh, Tuxxin's URL scanner, opens one link from several networks at once and compares what each receives. It scanned the original ad click links that William Vincent sent us.

Windows desktops on home broadband lines at Comcast, Charter and Cox got the scam. One Comcast visit got the scam and the next got the plain article. An Android phone on T-Mobile got a dating article, and a visit from a data center in France got a personal loan article.

The same ad link from a data center and from home broadband. whack.sh scan, October 8, 2026. The phone numbers are stamped FAKE.

The scam only appeared on visits that arrived through a fresh ad click. We opened the first ad's landing page directly eight times. Every visit returned the dating article.

Two operations used the same ad slot

The first ad led to a dating article site that covered itself with a full-screen frame from Microsoft Azure. The frame showed the fake alert while the address bar kept showing the dating site.

The second ad passed through a Branch deep link and a filtering server (TDS) that sorted visitors by network. Our home broadband visit went to a scam page on Azure with a live chat window. The same chat account appeared on another scam page on September 24, reached through a Taboola ad.

The scam kit runs on hundreds of cloud hostnames

The first operation's scam page comes from a kit, a set of files reused on every host. Public scans recorded it on 536 hostnames between July 12 and October 10, 2026, most of them on Microsoft Azure Container Apps. A second review by Kirk of ohey.ca added 31 of those hostnames. The pages listed 160 phone numbers, 126 of them US toll-free numbers.

The kit sends each visitor to a version for their operating system: Windows, macOS, Android or iOS. The Windows version adds a fake locked screen with a Microsoft account sign-in box. Its fields are read-only, and the box points the visitor to the phone number.

When we re-checked the hostnames on October 11, nine still served the kit.

How many people saw the ads

Taboola holds the impression and click counts for both ads. We reported both ad chains to Taboola on October 11, 2026 and requested those counts. No exposure counts have been supplied.

The first ad's tracking link listed a cost of 0.25 per click, with no currency.

Victims reported $1.46 billion in tech support fraud losses in 2024 to the FBI's Internet Crime Complaint Center. People aged 60 and over reported $982 million of that total.

What we reported

The scammers used services from each company below. We sent each one the evidence for its part on October 11, 2026, and filed reports with the FTC and the FBI.

Recipient	What we sent	Response as of October 11
Taboola	Both ad chains, with a request for impression and click counts	Case opened
Yahoo	Screenshots and a short alert offering the full report and indicator list. Its form could not take the full report.	Case opened
Microsoft Azure abuse portal	The Azure-hosted scam pages. Only the side-by-side capture above could be attached, so the hostname lists were left out.	Submitted, no case number given
Microsoft Report Fraud	The Microsoft impersonation and tech support scam	"Your request has been submitted."
Branch	The two deep link apps in the ad chains	"Thank you for your feedback!"
Tawk.to	The live chat account on the scam pages	"Report received."
apiip.net	The API key the scam pages used for location lookups	No reply
Vultr	The filtering server (TDS) address and the ad redirect chain	No reply
Namecheap	The filtering server (TDS) domain and the ad redirect chain	Case opened
Cloudflare Registrar	The ad landing domain, checkouters[.]app	Case opened
Cloudflare Trust and Safety	checkouters[.]app, then further context and a list of 13 Cloudflare Workers and Pages hosts running the kit	Said it could not detect abusive or malicious content and asked for more specific information. No reply yet to our follow-ups.
Laravel Forge	34 on-forge[.]com hosts running the kit	Laravel Security said it disabled "the domain in question" and notified the responsible party. The reply did not name the host, and we have not checked the result.
REG.RU	The tracker domain and how the scam pages used it	Request opened
Stellar Group	The tracker's server	No reply
FTC	The scheme and the callback numbers	Report filed
FBI IC3	The ad chains, callback numbers and technical evidence	Complaint filed

On the evening of October 11, Microsoft Edge showed a phishing warning for checkouters[.]app. When the warning first appeared, and what triggered it, is unknown.

If you saw this alert

Microsoft states that genuine Microsoft error messages never include a phone number to call. Close the browser tab. If the page blocks closing, end the browser in Task Manager on Windows or with Force Quit on a Mac.

If you called the number, uninstall any remote access tool the caller asked you to install. Change your passwords from another device and call your bank if you paid. Report the call at ic3.gov and reportfraud.ftc.gov.

Indicators

Domains are defanged. The whack.sh writeup has the full indicator list, and the 536 kit hostnames are in this CSV file.

Ad landing page: checkouters[.]app
Filtering server (TDS): maizerubyen[.]site
Scam pages: zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]io and w08win10m844n2491c001.z13.web.core.windows[.]net
Phone numbers: +1 844-959-2491, +1 888-883-5786 and +1 866-949-7055

Drafted with AI assistance.

This report is the original work of Tuxxin LLC, published under Creative Commons Attribution-NoDerivatives 4.0. Media and researchers may quote and republish it with attribution to Daniel Jones, Tuxxin LLC. The inbox screenshot appears with William Vincent's permission and is excluded from the license. For coordinated disclosure: contact@tuxxin.com.

Tuxxin launches Webfetch, a ScrapingBee-compatible scraping API

Daniel J — Mon, 26 Oct 2026 20:44:26 +0000

Webfetch, a web scraping API built and run by Tuxxin, is open at webfetch.io. A request names a URL and gets the page back as rendered HTML, plain text, markdown, or JSON pulled out with CSS or XPath selectors. The technical announcement, with the full credit table and every plan, is on the Webfetch blog.

Compatible with ScrapingBee

Webfetch takes the parameters, defaults and credit costs of ScrapingBee's HTML API. Code written for ScrapingBee moves over by changing the base URL and the key, unless it depends on AI extraction, scraping_config, ScrapingBee's dedicated APIs, or screenshots returned as the response body. Response headers change prefix from Spb- to Wf-, so code that reads them needs the new prefix. Plans with the same credit allowance cost 38 to 40% less, based on ScrapingBee's published prices on October 8, 2026.

Plans and the free tier

Signup confirms a free account with a six-digit code sent to its email address and asks for no card. Free credits start at 1,000, and the 1st of each month adds 250, up to a 1,000 balance. Self-serve plans run from Starter at $11.99 a month for 75,000 credits to Business+ at $359.99 a month for 8,000,000, and Custom plans on dedicated hardware start at $499 a month. Each subscription keeps the monthly price it started at for as long as it stays active.

Until December 7, 2026, the first 500 new accounts to enter LAUNCH500 at signup get 500 one-time bonus credits.

What a request gets

Webfetch bills a request only when the target's status is 2xx, 404, 410 or 413. Blocked requests, timeouts, other errors and anti-bot challenge pages cost nothing, even when a challenge page arrives with HTTP 200.
With mode=auto, Webfetch starts with the cheapest configuration and moves up after a block, a challenge page, a timeout, a failed connection or render, or a server error, charging for the one attempt that worked.
Screenshots are captured on Tuxxin's own servers, with webshot.site, Tuxxin's screenshot API, as the fallback.
robots.txt is honored by default, and private and internal network addresses are refused on every request and every redirect.

For developers and AI agents

Official SDKs for JavaScript, Python and PHP are on npm, PyPI and Packagist, with the source on GitHub. Webfetch also runs an MCP server at https://webfetch.io/mcp, so an AI client can fetch a page as markdown or extract structured data with the same API key.

Part of the Tuxxin Stack

Webfetch joins the other services Tuxxin builds and runs, including webshot.site for screenshots, whack.sh for URL threat scanning, issued.live for certificate and DNS data, and WorldIP.io for IP intelligence. The projects page lists all of them, Webfetch included.

Accounts open at webfetch.io/signup, and the home page runs a real scrape without a key.

How to detect residential proxies with a WorldIP.io beta key

Daniel J — Mon, 26 Oct 2026 20:44:05 +0000

WorldIP.io's paid API plans are planned to launch within the next 30 days. Until then, beta keys to the premium API come with issued.live subscriptions: issued.live Plus, at $99 a month, includes a WorldIP.io Pro key, and issued.live Pro, at $199 a month, includes a WorldIP.io Business key. The Pro key is the tier that detects residential proxies. Each key is emailed within one business day to the address on the issued.live subscription.

How to detect residential proxies

A residential proxy network routes traffic out through home internet connections, so its exit addresses belong to ordinary ISPs and pass a datacenter check. WorldIP.io identifies addresses acting as egress nodes for those networks. For one of them, the enriched lookup returns classification.verdict as residential_proxy and is_proxy as true, with a confidence that fades as the observation ages:

curl -s "https://worldip.io/api/v1/ext/lookup/$CLIENT_IP" \
  -H "Authorization: Bearer $WORLDIP_KEY" \
  | jq '.classification | {verdict, is_proxy, is_vpn, is_tor, confidence}'

Because the confidence decays, a gate can act on a fresh verdict and treat an old one as a reason for review.

Mobile proxy detection

Mobile proxy networks do the same through cellular connections, and the same verdict covers them: an egress node for a residential or a mobile proxy network returns residential_proxy.

Check if an IP is residential or datacenter

Most home addresses are ordinary connections. For the network type itself, the lookup returns access_type, and is_datacenter is true for hosting and cloud ranges. A rule can treat the two signals separately: a datacenter address on a consumer sign-up form, and a residential address flagged as a proxy exit, call for different responses.

Detect iCloud Private Relay

is_relay is true when the address is an Apple iCloud Private Relay egress, and relay_source names the relay. Private Relay is Apple's iCloud+ privacy service, so a gate can allow it and still record it next to the account.

Deny sign-ups from proxies

A sign-up or checkout gate needs one call per request:

curl -s "https://worldip.io/api/v1/ext/lookup/$CLIENT_IP" \
  -H "Authorization: Bearer $WORLDIP_KEY" \
  | jq -r '.classification | if .is_proxy or .is_vpn or .is_tor then "deny" else "allow" end'

The rule can be as strict as the form needs: deny detected proxies, send datacenter traffic to review, or allow everything and log the verdict.

What the beta keys include

The Pro key, normally $39 a month, carries 200,000 enriched lookups a month and 10 concurrent requests: the proxy, VPN, Tor and datacenter classification above, the access type, a trust score from 0 to 100, blocklist hits and basic BGP context, plus city-level geolocation where it exists, ASN type, regional registry ownership, reverse DNS and /24 neighbors.

The Business key, normally $129 a month, carries 1,000,000 enriched lookups a month and 20 concurrent requests, and adds live BGP prefixes and multiple-origin conflicts, BGP anomaly events through the Pulse API and Web3 node roles.

Proxy, VPN and Tor detection, the trust score and live BGP cover IPv4 addresses. An IPv6 lookup returns hosting classification, IPv6 blocklists and iCloud Private Relay detection.

What issued.live adds

WorldIP.io describes the address: who holds it, how it is routed and what kind of traffic leaves it. issued.live describes what has run at it, from the public Certificate Transparency logs, DNS resolved from seven vantage points and ICANN zone files. Its reverse IP and range lookups list every hostname seen answering at an address, with first-seen and last-seen times, and its certificate and SPKI pivots reach every name on a certificate and every certificate that shares a key. issued.live's guide shows how to find domains in an IP range.

WorldIP.io shows how many domains are hosted on an IPv4 address, on its IP pages and in its keyless API. issued.live lists them. The Tuxxin blog combines the two in hunting adversary infrastructure.

Terms of the beta key

Who qualifies: issued.live Plus and Pro subscribers. issued.live Basic is not included.
Delivery: by email within one business day, to the address on the issued.live subscription.
Duration: through the beta and for 30 days after WorldIP.io's paid plans launch. The key stays active while the issued.live subscription does.
Beta: the monthly quotas above apply, and the beta has no uptime guarantee.
Limits: the limits above may change during the beta; key holders are emailed before any change.

Subscribe on the issued.live pricing page. Every field is documented in the API reference.