-
594,101 knocks: who reads my site, and what AI crawlers can't see
AI systems read my site 1.5x as often as search engines and 58x as often as Google, mostly my signed threat-intel dossiers. One crawler hit my login page 594,101 times. What is public is the small part.
-
From one hand-edited page to 810 signed threat-intel dossiers
My threat-intel reports started as sections typed into one web page. When attackers targeted my own domain, the page became a liability. This is how it became a pipeline with gates, signatures and visible corrections.
-
Publishing with proof: signed reports, a Bitcoin ledger and a DOI
In April 2026 my threat reports were careful, and still just my word. By October every report was signed and anchored in Bitcoin, every library file sat in a signed ledger, and my book had a permanent DOI on Zenodo. Why proof mattered.
-
From log files to signed dossiers: how my threat-intel pages began
In April 2026 my threat reports were sections of one HTML page. By November a job re-signs 810 of them every six hours. How publishing grew from a Saturday's work to a signed archive, and why its most important page is a correction.
-
When my datasets started talking, the loudest link was my RSS feed
In May 2026 a linker joined my lab's separate security datasets into one graph. On 8 July its strongest cross-layer link turned out to be an RSS reader polling my own blog. 1,885 pairs became 6, and I learned to ask what chance would give.
-
Entity resolution lessons from a library and a threat-intel store
Six entity-resolution principles learned resolving authors in a 70,000-work library and networks in a threat-intel store: keep every claim, deterministic ids, decision tiers, lift over co-occurrence, no bulk lists, sample first.
-
Signing threat intelligence: Merkle trees, Ed25519 and one float
Every threat-intel dossier I publish carries an Ed25519-signed Merkle root anchored in Bitcoin. The method, a TAMPERED bug caused by 90.0, a verifier that trusted itself, and how to correct signed reports.
-
120 fake Googlebots, 9 real ones, and the week I banned Google
ASN checks let 77 fake Googlebots on Google Cloud through. How I verify crawlers with published IP ranges and forward-confirmed rDNS, ban impostor fleets, and how I accidentally banned the real Googlebot.
-
My SSH honeypot accepted every password, so it never banned anyone
194 attacker IPs escaped my honeypot's auto-ban for three months because it waited for failed logins. Lessons on ban-on-connect and building a honeypot log pipeline that fails loudly.
-
Typed decisions from logits: LLM judgements that cannot fabricate
Reading a 9B model's option probabilities instead of its text took a disambiguation task from 22.7% to 86.7%, added a usable confidence, and removed fabricated reasons. Most of the gain was wording.
-
Every attack here makes others safer
A honeypot, behavioural detection, blocking at the edge and a community that shares every verdict: how one machine near Iași turns attacks into protection for strangers.