Infoblox

Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned.

🔴 A threat isn't much of a threat if it can't reach the right victims. 📦️ That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. infoblox.com/blog/threat-in… 🧵

Well, 800-81r3 has just been published as an official set of recommendations and best practices. Here's what it means for you: brnw.ch/21x0SWK

🍾 Back on April 10, 2025, Cricket Liu mentioned that the @NIST had released a draft of a new version of their venerable “Secure Domain Name System (DNS) Deployment Guide,” called NIST SP 800-81 for short.

A reminder to travelers to be on the lookout for unusual domains ending in .buzz, .sbs, .top, .click, and .help TLDs and book directly through official ferry operators. As for us, that’s one sinking ship we’re glad we didn’t sail on 🛟 🆘

Recent examples: 🚫 ferryroutescanada[.]digital 🚫 washingtonferrytrip[.]buzz 🚫 australiafastferry[.]click 🚫 spainferryfast[.]help

Fear the Fake Ferry Fares ⚠️ ⛴️Searching online for ferry tickets? You may be saying "Bon Voyage"... but only to your credit card. 💳️ 🎣 While attempting to book a trip from Vancouver to Victoria, BC, one of our researchers nearly dropped anchor 🧵

DNS expert Cricket Liu joins David Bombal to explain encrypted DNS vs secure DNS, clear up common myths, and discuss the major NIST SP 800-81 update. Watch the video on YouTube: youtu.be/Rrr4HrI8E6g Thank you to @Infoblox for sponsoring this video.

Amit Kumar Singh, Regional Head - North & East India, Infoblox shares perspectives on how cybersecurity leaders are rethinking strategy in an era of AI, cloud, and expanding digital ecosystems. Know More: ciso.economictimes.indiatimes.com #ETCISO #ETCISOSecuFest #CyberSecurity

Download the latest @Gartner report to learn why traditional detection and response approaches are no longer enough—and why leaders must adopt unified, preemptive defense strategies: brnw.ch/21x0ETT #GartnerReport

NIOS helps you move faster with less risk while continuing to deliver new capabilities and value over the life of your investment. Learn more: brnw.ch/21x0CUH

without overhauling your infrastructure. Whether you’re just starting to implement enterprise-grade DDI or have been an Infoblox customer for years, the outcome is the same:

The Infoblox NIOS DDI platform just got its biggest expansion in years. This update is designed to help you get more value from your NIOS investment by automating the work that slows teams down and strengthening the security, resilience and compliance your network depends on 🧵

And then we built a graph of graphs: threat actors become nodes, and shared domain clusters form the edges — revealing coordination and shared infrastructure between groups that previously looked unrelated.

Two separate threat actor clusters can merge overnight when a new certificate creates a bridge between them. Tracking that evolution — knowing that cluster A and cluster B from yesterday are now the same entity today — while preserving historical continuity, is genuinely tricky.

For anyone interested in threat intelligence, data science, graph theory — or just curious how the internet really works under the hood. This started with a simple question: What hidden signals exist inside SSL certificates that we’re not fully using? infoblox.com/blog/security/…🧵