infosec

Saif al-Din Khader, known online as "Rey" and "Hikki-Chan," has been arrested in Jordan, according to reporting by Reuters journalists Raphael Satter, Dana Winter and Aj Vicens. Accounts in the cybersecurity community are circulating the news, saying he is allegedly cooperating with the FBI. Details about the charges remain limited so far.

ChainKeep, a tool aimed at digital forensics and incident response professionals, is being promoted with the message that every second matters in an investigation and that the software ensures every timestamp is accounted for. The pitch highlights chain-of-custody concerns in cybersecurity investigations, where accurate time records can determine whether evidence holds up. Discussion so far appears limited to infosec circles.

Cybersecurity researchers are warning about a suspected phishing website hosted on a Cloudways application domain (wordpress-1644952-6533726.cloudwaysapps.com). A link analysis of the address has been published on URLDNA so others can inspect the site's infrastructure. The warning is being circulated in infosec communities with the standard advice to treat the domain as unsafe.

Security researchers are warning about a phishing site impersonating DocuSign, hosted on a Webflow domain that mimics the e-signature service. The suspicious link has been defanged to prevent accidental clicks, and a public URL analysis has been shared so others can inspect the site's infrastructure. Infosec communities are circulating the alert to help people avoid credential theft scams that use fake document-signing pages.

A newly indexed entry on the Shodan search engine lists AS2514, an autonomous system number located in Tokyo, Japan, added on 29 September 2026. Infosec practitioners use such ASN listings to track exposed services across a network operator's address space and assess what is publicly reachable.

A vulnerability, tracked as CVE-2026-105134, has been reported in AhsayCBS, the backup software from Ahsay, affecting versions up to 10.3.2. The flaw was published on a threat-tracking service and is circulating among infosec communities, with security professionals flagging it for administrators who run Ahsay backup infrastructure. Details on severity and exploitation remain limited so far.

A newly registered entry in the Shodan internet-exposure database records AS5410, an autonomous system located in Chartres, France, added on 3 October 2026. Security researchers share such sightings under the shodansafari hashtag to track new networks and exposed devices appearing online.

Autonomous system AS24940, hosted in Falkenstein, Germany, was added to a Shodan watchlist on October 1, 2026, drawing attention in information security circles. The ASN is associated with Hetzner Online, a major German hosting provider frequently cited in discussions about exposed servers and internet scanning. Security researchers are tracking the network for newly exposed devices and services.

Cybersecurity researchers are warning about a suspected phishing site operating at facebooksecure.blogspot.com, which imitates Facebook to steal login credentials. The domain, hosted on Blogspot, has been submitted for analysis on UrlDNA, where its scan results are being shared across infosec communities. Experts advise users to check web addresses carefully before entering Facebook passwords, as attackers frequently use free hosting services for such scams.

Security researchers are warning about a phishing site hosted on a Blogspot domain impersonating Facebook video sharing. The URL, shared with defanged notation to prevent accidental clicks, has been submitted for automated analysis. Cybersecurity communities are circulating the alert to warn users not to enter Facebook credentials on the fake page.

Cybersecurity observers are warning about a suspected phishing link hosted on hipcv.com, a résumé and CV-related service. The URL has been defanged and shared with a link-analysis report on urldna.io so others can inspect its behaviour safely. People in the infosec community are urging caution before clicking such links, which are often spread through job or recruitment messages.

Network observers are discussing AS3320, the autonomous system number operated by Deutsche Telekom, with a data point logged in Reichenau, Germany. The entry, shared under security-research hashtags, is part of ongoing efforts to map exposed internet-connected devices by network and location. Little detail accompanies the record, so its significance for security researchers remains unclear.

Cybersecurity observers are flagging AS2514, an autonomous system based in Fukuoka, Japan, noting its recent addition to network monitoring on 2 October 2026. Autonomous systems are large blocks of internet routing infrastructure, and new entries like this are often tracked by researchers scanning for exposed or misconfigured services. Details beyond the network's identifier and location are limited so far.

Cybersecurity researchers are warning about a phishing site impersonating Roblox, hosted on the lookalike domain roblox.com.mu and advertising a community called 'BRAZILLIAN SPYDER'. An automated URL analysis of the address has been shared with the infosec community, which is passing the alert along so users avoid entering credentials on the fake page.

Security researchers are cataloguing AS18530, an autonomous system number registered in Bellevue, United States, as part of ongoing internet infrastructure mapping efforts. The entry was logged in an open network-registry watchlist used by infosec practitioners to track newly observed or noteworthy networks. Such listings typically help analysts monitor hosting providers, spot suspicious infrastructure, and share reconnaissance data with the wider security community.

A cybersecurity feed entry lists AS4134, the autonomous system number operated by Chinanet, with a location in Nanjing, China, timestamped 30 September 2026. The entry carries no further detail on why the network was added or what activity was observed on it. AS4134 is one of China's largest backbone networks, so listing it as a location marker rather than a threat indicator is unusual.

AS12876, an autonomous system based in Paris, France, was logged in an internet-wide network scan entry dated 30 September 2026. The autonomous system is associated with Scaleway, a French cloud and hosting provider. Cybersecurity practitioners track such networks to map exposed services and infrastructure, and the entry circulated among information security observers who follow scan-based reconnaissance of internet-facing systems.

Cybersecurity observers are warning about a suspected phishing site operating under the domain messagerlev0cal8883900.fo.team, a name that mimics Facebook Messenger's legitimate local addresses. The domain has been defanged and submitted to the URLdna scanning service for analysis, with the warning shared under cybersecurity and phishing tags. The deliberately confusing hostname suggests an attempt to trick users into entering login credentials on a fake page.

Cybersecurity observers are sharing a Shodan monitoring entry for AS16276, the network of French hosting provider OVHcloud, showing a location in Bexley in the United Kingdom, added on 29 September 2026. The listing is circulating among infosec practitioners as part of routine network reconnaissance and exposure-tracking activity.

The privacy-focused Android project GrapheneOS has released an update, prompting users in the information security community to ask whether its claims about iPhone and Apple iOS privacy and security hold up. The update was shared alongside a 404 Media report, fuelling debate about how Apple's security practices compare with hardened custom Android systems.

Autonomous system AS200740, registered to a location in Dhaka, Bangladesh, was added to the internet routing table on 2 October 2026. Cybersecurity researchers who track newly announced networks using Shodan are flagging the registration, a routine practice for spotting infrastructure that could be repurposed for hosting, proxies or malicious activity. No confirmed operator or purpose has been disclosed yet.

Cybersecurity observers are warning about a suspected phishing site hosted on a Weebly subdomain imitating First Jackson, with a link-out to a URL analysis report. Alerts like this circulate regularly in infosec communities so defenders can block or take down malicious pages. The defanged link is shared to prevent accidental clicks while allowing others to verify the finding.

Cybersecurity observers are warning about a suspected phishing website hosted on a Weebly subdomain, firstcsblog.weebly.com. The alert was shared with a defanged link to prevent accidental visits, alongside a URL analysis report from urldna.io documenting the site's characteristics. The warning circulated with tags covering phishing, scams and infosec, urging others to avoid the address.

Reports circulating in the cybersecurity community claim that a suspected member of the ShinyHunters hacking group, known online as 'Rey,' was detained in Jordan and is now cooperating with the FBI. The news is being shared among infosec professionals, with commenters noting it looks like a significant step forward against the group.

Cybersecurity watchers are circulating a warning about a possible phishing site hidden behind the shortened URL ppt.cc/fgcMAx, advising people not to click it. The link has been submitted to URLDNA for analysis, and the alert is being shared in infosec circles under phishing, scam and cybersecurity tags.

A security researcher has flagged a suspected phishing website hosted on a Weebly domain that impersonates an Air Miles rewards service login. The fake address, airmilesrewardsserviceoauth.weebly.com, was defanged to prevent accidental clicks, and a technical analysis of the site has been published via URLDNA. The warning is circulating among cybersecurity and infosec communities, who are urging users to avoid entering credentials on such pages.

Cybersecurity analysts are circulating a warning about a suspected phishing page hosted on a subdomain of premiumisp.net, sharing a defanged link and pointing followers to a URL analysis scan for details. The alert is being passed around infosec circles, with little additional context about who is being targeted or how the link is spreading.

Cybersecurity watchers are sharing details on AS9341, an autonomous system number registered in Bandung, Indonesia, listed on 1 October 2026 under the Shodan Safari tag. The hashtag refers to browsing Shodan, the search engine for internet-exposed devices, to spot vulnerable hosts by network. No specific vulnerability or incident has been named publicly so far.

Cybersecurity watchers are warning about a possible phishing site hosted on a suspiciously numbered subdomain of fo.team, a service often used to spin up quick temporary websites. The address has been shared in defanged form so others cannot accidentally click it, alongside a link to an automated URL analysis so people can inspect the site's behaviour. The alert is spreading through infosec communities where researchers routinely exchange indicators of compromise, scanning results, and warnings about newly created scam pages.

CloudSEK, a threat intelligence company, is promoting its participation in BSides VI 2026, a community-run cybersecurity conference. The company, which specializes in AI-driven threat intelligence and digital risk protection, is inviting attendees to learn more about its work ahead of the event. The announcement is circulating among information security professionals online.

Cybersecurity analysts are warning of a suspected phishing site hosted on weebly.com that impersonates a French webmail login page, apparently designed to steal email credentials. The suspicious URL was shared defanged with a link to an automated analysis on the URLdna scanning service. The warning circulated among infosec practitioners with the standard advice to treat such login pages with caution.