Freelancer account hygiene in one evening
The order of work on the accounts a freelancer lives from: invoice mail, domain, code host, backup, and the phone used for recovery. No pentest and no score.
Blog.
OPSEC, scams, online safety and cybersecurity. Read without an account. Implementation and assessments start from the form.
One target before a client asks about security
What a review of one domain, one code organization, or one mail tenant includes. Owner permission, read-only exports, and a report with no score out of ten.
Case: recovering a taken-over mailbox (teaching example)
A fictional but realistic small-business story: odd sign-in, the first hour, mistakes to avoid, mailbox recovery, then closing sessions and MFA.
Backup without jargon: will I survive tomorrow?
3-2-1 in plain language: how many copies, where they live, and whether you can restore one important file. For business owners — without immutable retention in the first sentence.
Black hats do not start with an exploit. They start with your exposure.
Attacks rarely begin with “breaking in”. They begin with what is visible from the internet: ports, admin panels, RDP and stale accounts. How to read exposure like a black hat — and close it lawfully.
Initial access brokers: black hats sell entry, not a movie break-in
Some attacks begin with purchased access: RDP, VPN, accounts. What an initial access broker is, why small firms are on the list, and what to do before ransomware shows up.
What the internet can see — without jargon
Company exposure in door-and-window language: what an owner can check in the hosting panel, who has remote access, and which old sites still face the internet.
You do not need a SOC — you need order
Before you buy 24/7 monitoring: accounts, email, exposure and backup in a sensible order. For SME owners — without SOC-subscription scare tactics.
How to become an ethical hacker: a legal path from the basics
Become an ethical hacker without crossing legal boundaries: learn networks, Linux, logs, safe labs, documentation and testing with explicit authorisation.
Online safety for children: a calm plan for parents
A practical online-safety plan for children and parents: accounts, privacy, games, messages, scams, reporting and what to do after an incident.
OPSEC: how to build a secure environment step by step
Build practical OPSEC without promises of invisibility: threat modelling, separated identities, secure devices, appropriate network paths and account recovery.
An invoice, the CEO's voice, and urgency: fraud in the AI era
BEC, a changed supplier bank account, and a cloned voice exploit the same gap: an urgent instruction moves outside the normal payment process.
An alert without an owner fixes nothing
Practical SecOps automation starts with complete input, an owner, and a decision trail — not a bot that closes incidents by itself.
Facebook friend scam: a BLIK code in Messenger
A Facebook friend scam often starts with an urgent payment request from a taken-over account. A BLIK code sent in Messenger can be cashed out at once.
OLX scam: a fake payment page
An OLX or Marketplace scam can use a real ad and a fake page to “receive the money”. Logging into a bank is not how you collect payment for a parcel.
A router out of the box — seven settings to review
Factory router settings are a starting point, not complete protection. Review updates, admin access, Wi-Fi, WPS, guests, IoT, and internet-facing access.
Internet-facing RDP is not a remote-work plan
A public RDP port increases attack surface. Safer access starts with closing exposure, using a gateway or VPN, MFA, and useful logs.
Isolation — one failure should not open the rest
Why isolation matters: the account, the host, the backup, and the admin path fail separately. Otherwise a laptop compromise is an environment compromise.
Your phone is gone: the first hour
What to do in the first hour after a phone is lost or stolen: lock, locate, protect the SIM, contact the bank, and decide about remote erase.
Network segmentation — a zone starts at the filter
A VLAN with no rule between them is still one network. Segmentation is the list of who is allowed to talk to whom.
Passkeys and security keys without the jargon
How a passkey differs from a password, SMS code, and authenticator code — and how to switch without losing account access.
Ransomware: the first hour without destroying evidence
How to contain ransomware, preserve evidence, and keep an honest timeline before you know the full scope of the incident.
Ransomware-resistant backups: boundaries, retention, and restore tests
A ransomware-resistant backup needs a boundary: separate credentials, offline or immutable versions, retention, and regular restore tests.
AnyDesk scam: “bank support” over remote desktop
An AnyDesk or TeamViewer scam starts with a call from “the bank”, remote-desktop software and a hidden transfer. Where to stop and what to do next.
Call before you send a code
A request for a BLIK code, a text-message code, or a bank password needs a check by another phone call, or inside the ad itself. Urgency in the chat does not replace that.
Session theft: when changing the password is not enough
How a browser session works, what an infostealer takes, and why incident recovery includes signing out devices, not only changing a password.
SPF, DKIM, and DMARC — protecting the company name in email
SPF, DKIM, and DMARC reduce domain spoofing, but each proves something different and none of them ends phishing.
Tor and Whonix on Qubes OS — one option
Tor hides the path of a connection from any single relay. Whonix on Qubes OS puts a workstation behind a gateway that runs Tor. That is a layout, not a cloak.
Hacking without hacking skills — what AI can already do
Kali plus a local model plus MCP can run tools and read the output. That is not a pentest without skill. Without written consent or your own lab it is illegal scanning.
Recovering data from an HDD with DMDE — and why an SSD is a different machine
DMDE on an HDD image can be routine. On an SSD the same Recycle Bin click goes through FTL and TRIM. The difference is the media, not a better program.
The cash man
A reportage about cash, the chain, and a substitute for trust. Invisibility on the internet is one of the most oversold ideas there is.
The first 15 minutes of an L1 alert
A lab alert is not an incident. A note with host, time and the next question beats a dashboard screenshot.
SOC L1 Home Lab: environment architecture
A light L1 lab: host, two endpoints, a collector. The data path matters more than the tool pile.
Wazuh as a starting point for SIEM
From an endpoint log to an alert you can keep or close. Wazuh in a lab, not on a slide.
Windows Event Logs for SOC L1
Source and context beat a memorised number. Security, process, PowerShell — if audit is even on.
Not sure where to start?
Pick a quote, consultation or engagement path — or describe the problem now. No obligation to sign.