Suspicious domain ms365update[.]com was registered through MonoVM on 6/22/26 using juliarhorton@onionmail[.]org (H/t @domaintools.bsky.social). Today the domain began using Cloudflare and its subdomain www.ms365update[.]com now redirects to Google DNS.

The dark money group’s democracyunmuted[.]org domain is almost certainly administered using the same Cloudflare account as demfluencers[.]com. The latter—originally registered in June 2025 and operational in the Nov/Dec timeframe—claims to provide paid opportunities and access for influencers.

Between 10 and 11 September 2025, the “Know your voting rights” entry for college students was removed from vote.gov. While not definitively related, this coincides with the timeframe—8 September 2025 per the earliest cert—when National Design Studio ostensibly began working on the site.

New toadie site in the works: 47compliance[.]org Highly likely administered using the same Cloudflare account as a number of other pro Trump/GOP and anti Dem sites, including: insidebidensbasement[.]org kamalaskoup[.]org protect47[.]org

New Children's Health Defense site registered on 1/9/26 and currently in development: covidjustice[.]org covidjustice[.]metalteam[.]dev (69.16.249[.]248, dev site)

Suspicious domain ms-driversync[.]com was registered through Njalla on 10/14/25 and resolves to 192.166.82[.]94.

Suspicious domain mfa[.]directory was registered through Njalla on 10/15/25 and resolves to 149.33.2[.]67.

Looking forward to finally presenting this research into Volt Typhoon in a public forum - and I can't think of a better one than @cyberwarcon.bsky.social www.cyberwarcon.com/forecasting-...

Have you ever wanted to see two terminally online nerds really (and I mean *really*) get into the SVR deep lore while continuing the eternal goal of making 2016 last forever? Gosh does @cyberwarcon.bsky.social have a talk for you!

We've got some good submissions flowing into the @CYBERWARCON CFP, but there's still time for more. If you have good content, and you're worried the honorarium won't cover your travel, please submit, and we'll work it out. We do this because we believe this research matters.

Best conference in the industry is back! cyberwarcon.com

Suspicious domains micrsosft-netupdate[.]net (109.107.172[.]123) and micrsosft-netupdate[.]net (146.103.115[.]183) were co-registered through Njalla on 8/14/25.

Suspicious domain adobereader[.]cc was registered through MonoVM on 8/5/25 using freewanatoly@2mail[.]co. Currently resolves to M247 IP 84.252.95[.]40.

Suspicious domain sophossec[.]com was registered through MonoVM on 7/15/25 using kehmar.maung@proton[.]me and resolves to 146.70.247[.]55.

Of all my professional accomplishments, I think I’m proudest of this.

Suspicious domains awsonlineserch[.]com and azuronlineserch[.]com were co-registered through Njalla on 6/19/25. Currently resolving to 34.204.12[.]191 and 20.83.167[.]25, respectively.

Suspicious domain windowsntp[.]com was registered through Njalla on 5/22/25 and then began using Cloudflare. Domain itself does not resolve, but subdomain www.windowsntp[.]com indicates MSFT Azure use.

Suspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.

Highly likely Parscale / Nucleus-administered domain congressstrongaction[.]org was registered on 9/23/24 and recently began hosting content. The org's stated policy positions appear largely aimed at curtailing laws and protections related to natural resources.

Set of suspicious domains co-registered through Njalla on 4/24/25: esxiupdate[.]com threatbook[.]cloud Not currently resolving, but worth keeping an eye on.

Set of suspicious domains registered on 4/2/25 (unclear through which reseller) and administered using the same Cloudflare account: googlealert[.]net microsoft365signin[.]net microsoftalert[.]net outlooksecurity[.]net outlooksignin[.]net

Suspicious domain analytics[.]airforce was registered through Njalla on 4/2/25 and resolves to BL Networks IP 64.52.80[.]61.

The Children's Health Defense staging site associated with realcdc[.]org indicates they are setting it up to pose as a legitmate CDC site questioning vaccine safety, complete with parent testimonials. Currently no overt indication the site is run by CHD.

Suspicious domain chromeupdate[.]net was registered through Njalla on 3/11/25. Not currently resolving, but worth keeping an eye on.

Suspicious domain nvidia-installer[.]com was registered through Njalla on 3/10/25 and resolves to 51.44.166[.]225.

Two suspicious domains co-registered through Njalla on 3/6/25: sfsimpact[.]org and dogechronicle[.]com. The former purports to be an independent analysis claiming inefficiency in the NSF CyberCorps Scholarship for Service (SFS); the latter claims to report on DOGE activity. (1/4)

Suspicious domain downloadfile-dropbox[.]com was registered through Njalla on 2/21/25 and is hosted at 86.54.42[.]36.

Suspicious domain onelivedrv[.]com was registered through Njalla on 2/20/25 and is hosted at 193.42.39[.]159.

Suspicious domain vmware-analytics[.]com was registered through Njalla on 2/17/24. Not currently resolving, but subdomain app.vmware-analytics[.]com shows resolution to 178.131.20[.]47.

Domain dogestatus[.]org was registered on 2/14/25 and is likely administered using IMGE's Cloudflare account—the same one used for the fake Harris campaign site progress2028[.]com. www.opensecrets.org/news/2024/10... Not currently resolving.

“Impact” of IO is notoriously hard to measure. The Breakout Scale, from @benimmo.bsky.social, continues to be one of the best tools for doing so. This one is a great example of a “Category 5” op, if the attribution to Overload/Matryoshka is indeed correct.

I missed this yesterday, but new Attorney General Pam Bondi used her first day on the job to disband the FBI's Foreign Influence Task Force, which has been a key part of government efforts to stop adversaries from meddling in U.S. democracy: https://bit.ly/4jK0RC5

Suspicious domain sentinleone[.]com was registered through MonoVM on 2/3/25 using rachellecaya62@proton[.]me. Domain resolves to 185.174.101[.]117. Same email address was used for two other domains in late 2024 that are hosted on 177.136.225[.]169: copilotassistants[.]com copilotcrmcloud[.]com

Little behind on announcing this, but #binjaxtras is now available in BinaryNinja’s plugin manager! #BinaryNinja

Suspicious domain homegrouplistener[.]com was registered through THCservers on 1/30/25 using revofresh@tutamail[.]com. Currently resolves to 144.172.113[.]80.

Suspicious domain fortigate-cloud[.]com was registered through Njalla on 1/28/25. Domain uses Cloudflare and doesn't resolve, but Censys indicates subdomain cdn.fortigate-cloud[.]com in use at a MeshCentral server on 185.193.127[.]21.

Suspicious domain updatemicfosoft[.]com was registered through Njalla on 1/28/25. Subdomain www.updatemicfosoft[.]com shows resolution to BL Networks IP 64.190.113[.]13.

Domain realcdc[.]org was registered on 1/23/25 and is administered using the same Cloudflare account used for the Children's Health Defense (CHD). Other sites on its cert: cdc.chdstaging[.]org f428ecee2d.nxcli[.]io

Suspicious domain securityupdatereleases[.]com was registered through MonoVM on 1/16/25 using matondo-atabong@tutamail[.]com. Not currently hosted, but worth keeping an eye on.

What seems to be the latest Storm-1516 disinformation campaign referring to recently created website presseneu[.]de: "Germany plans to import 1.9 million Kenyan workers"

Suspicious domain proxy-waf[.]com was registered through MonoVM on 12/15/24 using yuyu47@onionmail[.]org. Domain resolves to EDIS GmbH IP 151.236.15[.]37. Potentially an issue: Google search provides an AI response that the site is used for protecting web apps. Seems like an oversight for an NRD.

Suspicious domain timesyncserver[.]com was registered through Njalla on 12/4/24 and resolves to 85.239.34[.]155.

Suspicious domain google-analyze[.]com was registered through MonoVM on 11/29/24 using corbin.kund10@mail[.]ee. Resolves to 91.132.95[.]168.

Suspicious domain msdefender[.]net was registered on 12/1/24—through PDR but unsure where specifically—using msdefender@onionmail[.]org. Currently using Cloudflare.

A hypothesis I've been toying with is that privately organized active measures - aimed at winning elections, eliminating business rivals, swinging lawsuits, etc - are far more common than is popularly understood.

Suspicious domain afpicenter[.]com was registered through MonoVM on 11/15/24 using steven.streejed@tutamail[.]com. Not currently hosted, but worth keeping an eye on.

Infrastructure registered within the last month and highly likely administered using the same Cloudflare account as America PAC: doge2026[.]com (11/13) dogeamerica[.]org (11/13) doge2025[.]com (10/14) Not currently hosting any content.

Big wins for entropy today

Suspicious domain sslvpn-cisco[.]com was registered through Njalla on 11/13/24 and is using Cloudflare.

Suspicious domain owamfa[.]email was registered through Njalla on 6/5 and resolves to 139.59.8[.]35. DomainTools and Censys indicate a previous resolution to 38.180.39[.]11.