Articles
Short case notes, with their source chain.
Each note takes one claim, goes back to the source, and stops where the evidence ends.
What stopped the worm was a domain registration.In 2017, registering an unused domain inside a worm stopped that sample. On 30 August 2026 the same name still answers.Cropping is not enough. The metadata stays.A public news photo from 2012 still carries EXIF after a crop and Photoshop. Cropping is not enough.A floppy disk did not catch a killer on its own. The technical traces and DNA chain in the Wichita caseOnline retellings often reduce this case to one sentence. A killer forgot his name on a floppy disk and the police caught him. In reality, the disk only pointed investigators in a direction. That lead was tested through open web research, security footage, surveillance, preserved biological evidence, and a targeted kinship DNA comparison authorized by a court. This article follows the evidence chain rather than the legend.How a phishing campaign moved from an email to session token theftA Microsoft report shows that modern credential phishing is no longer limited to a fake sign-in page. This file examines how a code-of-conduct email, a document attachment, and several redirect steps formed one social engineering chain.The fuel blockade that locked a city's supply routesThe city's fuel crisis was not the result of one attack. Open source traces connected vehicle attacks, satellite imagery, videos, and growing queues to the same pattern of pressure.