Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Threat Intelligence
Newest first
Lookalike Domains: Punycode, Homoglyphs, Typosquats and Combosquats
A Cyrillic "а" and a Latin "a" are different domains that look identical. How IDN homoglyph attacks, punycode, typosquatting and combosquatting work, how browsers decide what to show, and how to build brand monitoring that catches lookalikes without drowning in noise.
Certificate Transparency for Phishing Hunters: Catch the Domain Before the Email
Almost every phishing site wants a padlock, and every publicly trusted certificate is written to a public log. How to read an X.509 certificate, how Certificate Transparency works, and how to turn CT logs into an early warning feed for lookalike domains.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note