Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#typosquatting
Newest first
Malicious Open-Source Packages: How They Get In and How to Keep Them Out
Typosquats, dependency confusion, hijacked maintainers, install scripts and protestware all exploit the same reflex: trusting whatever the registry hands you. How each technique works, how to vet a dependency in ten minutes, and why a release cooldown is the cheapest control you are not using.
Lookalike Domains: Punycode, Homoglyphs, Typosquats and Combosquats
A Cyrillic "а" and a Latin "a" are different domains that look identical. How IDN homoglyph attacks, punycode, typosquatting and combosquatting work, how browsers decide what to show, and how to build brand monitoring that catches lookalikes without drowning in noise.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note