Notes from the sensors.
Research and practice from the GriffinGuard team on threat intelligence, honeypot data and security operations.
Citrix NetScaler scanning in September 2026
Port 443, proxies and request headers. We observed generic NetScaler fingerprinting alongside targeted validation through residential proxies after the September disclosure.
Understanding Honeypot Data: What Edge Devices Reveal About Global Threats
Honeypots have long been a staple in the defender's toolkit. But when deployed at scale across edge infrastructure, they paint a far richer picture of attacker behavior than traditional approaches.
Cluster-scale malware delivery
Large machine learning clusters equipped with powerful GPUs are an attractive target for crypto-mining malware. We investigate active exploitation of exposed Ray orchestration endpoints that compromise entire clusters in one fell swoop.
Reducing SOC Alert Fatigue with IP Reputation Enrichment
IP reputation enrichment can add context to SOC alerts. Learn how to evaluate it safely in your own workflow.