iiinova — where your digital self keeps evolving

Kyle Ehmke @kyleehmke.bsky.social · 02/10/2026

Suspicious domain awsinternal[.]com was registered through Njalla on 10/1/26. Domain itself not presently resolving, but subdomain cloud.awsinternal[.]com is hosted at M247 IP 162.252.172[.]197.

001

Kyle Ehmke @kyleehmke.bsky.social · 21/09/2026

Google‘s AI Overview providing the domain a veneer of legitimacy that is based on the redirect location and not the domain’s characteristics/provenance.

011

Kyle Ehmke @kyleehmke.bsky.social · 16/09/2026

Domain tellhhs[.]org was registered on 9/15/26 and is almost certainly administered via Children's Health Defense's Cloudflare account. It redirects to a Federal Register entry seeking input on categories used in federal vaccine recs, highly likely indicating CHD’s intent to flood it with comments.

131

Reposted by Kyle Ehmke

CYBERWARCON @cyberwarcon.bsky.social · 10/09/2026

CYBERWARCON is BACK for 2026! Registration and CFP are now officially open! We’ll be in Arlington, VA+ virtually on November 20th, with Rob Joyce as our keynote. cyberwarcon.com 1/x

21917

Reposted by Kyle Ehmke

Sean Lyngaas @snlyngaas.bsky.social · 08/07/2026

"A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons ..." krebsonsecurity.com/2026/07/felo...

krebsonsecurity.com

Felons, Fraudsters Flog Offensive Cybersecurity Startup

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most...

295

Kyle Ehmke @kyleehmke.bsky.social · 29/06/2026

Suspicious domain ms365update[.]com was registered through MonoVM on 6/22/26 using juliarhorton@onionmail[.]org (H/t @domaintools.bsky.social). Today the domain began using Cloudflare and its subdomain www.ms365update[.]com now redirects to Google DNS.

221

Kyle Ehmke @kyleehmke.bsky.social · 13/03/2026

The dark money group’s democracyunmuted[.]org domain is almost certainly administered using the same Cloudflare account as demfluencers[.]com. The latter—originally registered in June 2025 and operational in the Nov/Dec timeframe—claims to provide paid opportunities and access for influencers.

021

Kyle Ehmke @kyleehmke.bsky.social · 25/02/2026

Now hosting content for a Senate resolution proposed by CHD, Autism Action Network, Health Freedom Defense Fund, Stand For Health Freedom, and The Brownstone Institute. TLDR: it’s a lot of anti-vax advocacy’s greatest hits.

111

Kyle Ehmke @kyleehmke.bsky.social · 05/02/2026

The linked guide to voting page for college students was removed and currently returns a Page not found error. Most recent available entry from early September available here: web.archive.org/web/20250903...

web.archive.org

Voting as a college student | Vote.gov

Find out where and how to register and vote in national, state, and local elections as a college student.

000

Kyle Ehmke @kyleehmke.bsky.social · 05/02/2026

Between 10 and 11 September 2025, the “Know your voting rights” entry for college students was removed from vote.gov. While not definitively related, this coincides with the timeframe—8 September 2025 per the earliest cert—when National Design Studio ostensibly began working on the site.

100

Kyle Ehmke @kyleehmke.bsky.social · 24/01/2026

New toadie site in the works: 47compliance[.]org Highly likely administered using the same Cloudflare account as a number of other pro Trump/GOP and anti Dem sites, including: insidebidensbasement[.]org kamalaskoup[.]org protect47[.]org

010

Kyle Ehmke @kyleehmke.bsky.social · 22/01/2026

New Children's Health Defense site registered on 1/9/26 and currently in development: covidjustice[.]org covidjustice[.]metalteam[.]dev (69.16.249[.]248, dev site)

122

Kyle Ehmke @kyleehmke.bsky.social · 15/10/2025

Suspicious domain ms-driversync[.]com was registered through Njalla on 10/14/25 and resolves to 192.166.82[.]94.

021

Kyle Ehmke @kyleehmke.bsky.social · 15/10/2025

Suspicious domain mfa[.]directory was registered through Njalla on 10/15/25 and resolves to 149.33.2[.]67.

042

Reposted by Kyle Ehmke

Joe Slowik @pylos.co · 08/10/2025

Looking forward to finally presenting this research into Volt Typhoon in a public forum - and I can't think of a better one than @cyberwarcon.bsky.social www.cyberwarcon.com/forecasting-...

cyberwarcon.com

Forecasting Typhoons: Volt Typhoon Next Steps in OT Disruption — CYBERWARCON

0348

Reposted by Kyle Ehmke

Horkos @wylienewmark.bsky.social · 08/10/2025

Have you ever wanted to see two terminally online nerds really (and I mean *really*) get into the SVR deep lore while continuing the eternal goal of making 2016 last forever? Gosh does @cyberwarcon.bsky.social have a talk for you!

cyberwarcon.com

Oil Into The Fire — CYBERWARCON

2448

Reposted by Kyle Ehmke

John Hultquist @hultquist.bsky.social · 18/09/2025

We've got some good submissions flowing into the @CYBERWARCON CFP, but there's still time for more. If you have good content, and you're worried the honorarium won't cover your travel, please submit, and we'll work it out. We do this because we believe this research matters.

053

Kyle Ehmke @kyleehmke.bsky.social · 28/08/2025

Kim John Un rolls off the tongue nicely

010

Kyle Ehmke @kyleehmke.bsky.social · 28/08/2025

Best conference in the industry is back! cyberwarcon.com

1102

Kyle Ehmke @kyleehmke.bsky.social · 14/08/2025

Suspicious domains micrsosft-netupdate[.]net (109.107.172[.]123) and micrsosft-netupdate[.]net (146.103.115[.]183) were co-registered through Njalla on 8/14/25.

100

Kyle Ehmke @kyleehmke.bsky.social · 06/08/2025

Suspicious domain adobereader[.]cc was registered through MonoVM on 8/5/25 using freewanatoly@2mail[.]co. Currently resolves to M247 IP 84.252.95[.]40.

020

Kyle Ehmke @kyleehmke.bsky.social · 16/07/2025

Suspicious domain sophossec[.]com was registered through MonoVM on 7/15/25 using kehmar.maung@proton[.]me and resolves to 146.70.247[.]55.

011

Reposted by Kyle Ehmke

Horkos @wylienewmark.bsky.social · 24/06/2025

Of all my professional accomplishments, I think I’m proudest of this.

6545

Kyle Ehmke @kyleehmke.bsky.social · 23/06/2025

Likely related domains drowingaws[.]com (13.217.161[.]160) and drowingazur[.]com (20.163.58.252) were co-registered through Njalla on 6/20/25.

010

Kyle Ehmke @kyleehmke.bsky.social · 20/06/2025

Suspicious domains awsonlineserch[.]com and azuronlineserch[.]com were co-registered through Njalla on 6/19/25. Currently resolving to 34.204.12[.]191 and 20.83.167[.]25, respectively.

111

Kyle Ehmke @kyleehmke.bsky.social · 23/05/2025

Suspicious domain windowsntp[.]com was registered through Njalla on 5/22/25 and then began using Cloudflare. Domain itself does not resolve, but subdomain www.windowsntp[.]com indicates MSFT Azure use.

011

Kyle Ehmke @kyleehmke.bsky.social · 19/05/2025

Suspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.

183

Kyle Ehmke @kyleehmke.bsky.social · 16/05/2025

Most of the latter policy positions are copied from the American Stewards of Liberty page here: web.archive.org/web/20250516...

web.archive.org

16 Ways to Reverse 30x30 - American Stewards of Liberty

Share this page...

010

Kyle Ehmke @kyleehmke.bsky.social · 16/05/2025

Highly likely Parscale / Nucleus-administered domain congressstrongaction[.]org was registered on 9/23/24 and recently began hosting content. The org's stated policy positions appear largely aimed at curtailing laws and protections related to natural resources.

111

Kyle Ehmke @kyleehmke.bsky.social · 24/04/2025

Set of suspicious domains co-registered through Njalla on 4/24/25: esxiupdate[.]com threatbook[.]cloud Not currently resolving, but worth keeping an eye on.

011

Kyle Ehmke @kyleehmke.bsky.social · 03/04/2025

Set of suspicious domains registered on 4/2/25 (unclear through which reseller) and administered using the same Cloudflare account: googlealert[.]net microsoft365signin[.]net microsoftalert[.]net outlooksecurity[.]net outlooksignin[.]net

052

Kyle Ehmke @kyleehmke.bsky.social · 02/04/2025

Suspicious domain analytics[.]airforce was registered through Njalla on 4/2/25 and resolves to BL Networks IP 64.52.80[.]61.

021

Kyle Ehmke @kyleehmke.bsky.social · 21/03/2025

The Children's Health Defense staging site associated with realcdc[.]org indicates they are setting it up to pose as a legitmate CDC site questioning vaccine safety, complete with parent testimonials. Currently no overt indication the site is run by CHD.

142

Kyle Ehmke @kyleehmke.bsky.social · 11/03/2025

Suspicious domain chromeupdate[.]net was registered through Njalla on 3/11/25. Not currently resolving, but worth keeping an eye on.

032

Kyle Ehmke @kyleehmke.bsky.social · 11/03/2025

Suspicious domain nvidia-installer[.]com was registered through Njalla on 3/10/25 and resolves to 51.44.166[.]225.

042

Kyle Ehmke @kyleehmke.bsky.social · 06/03/2025

Again, not saying that's what is happening here. Nor am I stating the conclusions in the SFS site are incorrect or that there is malicious intent behind it. Unfortunately, it is a concerning vulnerability to IO predicated on shortsighted reactivity that we have to consider these days. (4/4)

130

Kyle Ehmke @kyleehmke.bsky.social · 06/03/2025

Get that site in front of DOGE and then they decide to take a chainsaw to the program due to the claimed inefficiency. That's a big, and seemingly easy, information operations (IO) win for the actor. (3/4)

121

Kyle Ehmke @kyleehmke.bsky.social · 06/03/2025

Not saying that this is what is happening here, but consider an actor wants to impact a US government program like SFS. They could cook up a DOGE-looking site replete with links to claimed sources, while making up or using incomplete statistics to claim inefficiency in that program. (2/4)

120

Kyle Ehmke @kyleehmke.bsky.social · 06/03/2025

Two suspicious domains co-registered through Njalla on 3/6/25: sfsimpact[.]org and dogechronicle[.]com. The former purports to be an independent analysis claiming inefficiency in the NSF CyberCorps Scholarship for Service (SFS); the latter claims to report on DOGE activity. (1/4)

145

Kyle Ehmke @kyleehmke.bsky.social · 21/02/2025

Suspicious domain downloadfile-dropbox[.]com was registered through Njalla on 2/21/25 and is hosted at 86.54.42[.]36.

032

Kyle Ehmke @kyleehmke.bsky.social · 20/02/2025

Suspicious domain onelivedrv[.]com was registered through Njalla on 2/20/25 and is hosted at 193.42.39[.]159.

012

Kyle Ehmke @kyleehmke.bsky.social · 18/02/2025

Suspicious domain vmware-analytics[.]com was registered through Njalla on 2/17/24. Not currently resolving, but subdomain app.vmware-analytics[.]com shows resolution to 178.131.20[.]47.

021

Kyle Ehmke @kyleehmke.bsky.social · 14/02/2025

Domain dogestatus[.]org was registered on 2/14/25 and is likely administered using IMGE's Cloudflare account—the same one used for the fake Harris campaign site progress2028[.]com. www.opensecrets.org/news/2024/10... Not currently resolving.

075

Reposted by Kyle Ehmke

Sam Riddell @riddellsam.bsky.social · 06/02/2025

“Impact” of IO is notoriously hard to measure. The Breakout Scale, from @benimmo.bsky.social, continues to be one of the best tools for doing so. This one is a great example of a “Category 5” op, if the attribution to Overload/Matryoshka is indeed correct.

02311

Reposted by Kyle Ehmke

Eric Geller @ericjgeller.com · 06/02/2025

I missed this yesterday, but new Attorney General Pam Bondi used her first day on the job to disband the FBI's Foreign Influence Task Force, which has been a key part of government efforts to stop adversaries from meddling in U.S. democracy: bit.ly/4jK0RC5

28367176

Kyle Ehmke @kyleehmke.bsky.social · 03/02/2025

Suspicious domain sentinleone[.]com was registered through MonoVM on 2/3/25 using rachellecaya62@proton[.]me. Domain resolves to 185.174.101[.]117. Same email address was used for two other domains in late 2024 that are hosted on 177.136.225[.]169: copilotassistants[.]com copilotcrmcloud[.]com

020

Reposted by Kyle Ehmke

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 31/01/2025

Little behind on announcing this, but #binjaxtras is now available in BinaryNinja’s plugin manager! #BinaryNinja

142

Kyle Ehmke @kyleehmke.bsky.social · 31/01/2025

Suspicious domain homegrouplistener[.]com was registered through THCservers on 1/30/25 using revofresh@tutamail[.]com. Currently resolves to 144.172.113[.]80.

012

Kyle Ehmke @kyleehmke.bsky.social · 30/01/2025

Suspicious domain fortigate-cloud[.]com was registered through Njalla on 1/28/25. Domain uses Cloudflare and doesn't resolve, but Censys indicates subdomain cdn.fortigate-cloud[.]com in use at a MeshCentral server on 185.193.127[.]21.

031