whackNews · Threat Intelligence
Research notes, threat write-ups, and product updates from the whack.sh team.
Referer-gated cloaking: why our scanner arrives with a source
Referer-gated cloaking branches on where a visitor says they came from, so a scanner that opens a URL cold lands in the clean branch by the operator's own rule. Our scanner can set that source and carry it through the redirect chain, so the page answers as it answers the intended visitor.
#4 on MalwareBazaar — what that proves, and what it does not
whack.sh launched on August 6th. Nearly three weeks in, it is the fourth-largest contributor to abuse.ch MalwareBazaar, alongside GovCERT.ch. That proves the detection pipeline finds real, live malware — verified by three independent platforms. It does not prove we are finding what nobody else can, and we would rather say so.