2025-09-19
Routing Anomalies and What They Hide
Not every BGP anomaly is interesting. The ones that are usually look identical to the ones that are not.
Read →
2025-09-02
The Quiet Periods
When adversaries go dark, the silence itself is data. A note on observation behaviour during operational pauses.
Read →
2025-08-18
Ten Years of Observing the Same Port
A decade of records for a single TCP port, what it reveals about software lifecycles, and what it does not.
Read →
2025-08-04
The Honeypot Question
When a honeypot is useful, when it is theatre, and how to tell which one you are looking at.
Read →
2025-07-20
On Vendor Telemetry
Commercial telemetry is not reconnaissance, and it does not become reconnaissance by being aggregated. A position note.
Read →
2025-07-05
Provenance, Chain of Custody
Why the path from observation to claim matters more than the observation itself, and how we keep it intact.
Read →
2025-06-22
The Limits of Inference
There are claims the dataset can support and claims it cannot, no matter how compelling the pattern looks. On knowing the difference.
Read →
2025-06-06
Reading the Issuance Curve
Certificate issuance shapes are surprisingly diagnostic. A short essay on what the curve tells you about who is operating.
Read →
2025-05-23
What the Map Cannot Show
On the things we observe but cannot publish, and the things we cannot observe at all.
Read →