ℹ️ This listing was auto-generated from Mastodon's public data. Randy hasn't claimed it, and it doesn't imply any partnership with or endorsement of SocialDB.
Is this you? Claim it · Request removal (free).
🤝
Make a deal with Randy
🔒 Paid proposals held safely in escrow — released only when the work's approved.
Followers
512
Account age
3 yrs
💰 Suggested sponsorship rate
$40 – $65 / sponsored post
Estimated from audience size & typical reach — every deal is negotiable and held in SocialDB escrow.
🧰 Free analysis for Randy
Known for
11 views
Wrote up an analysis of a perl-based macOS/linux stealer. I wasn't able to find any other references to this, thus the inspiration for the write-up. Decided to give it a name:
Pearl Stealer
https://rmceoin.github.io/malware-analysis/2025/07/20/pearl-stealer.html
7 views
One less fake browser update campaign. Not to be left out, #SmartApeSG has switched to the #ClickFix technique.
![we see TOADs coming from web.core.windows[.]net everyday. they all use the same template. yesterday a new template came across from my.id and i thought the sequence with a fake CMD sequence was hilarious.](/img?u=https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Fmedia_attachments%2Ffiles%2F115%2F271%2F997%2F737%2F524%2F274%2Fsmall%2F7fbc55948f0bbab5.png)
5 views
we see TOADs coming from web.core.windows[.]net everyday. they all use the same template. yesterday a new template came across from my.id and i thought the sequence with a fake CMD sequence was hilarious.
![These sites are still serving up Pearl Stealer.akwatic-hotel[.]ci
ardiellifornasa[.]ge
bleulab[.]ci
clasoftmedia[.]ci
gtl[.]ci
rafelink[.]life](/img?u=https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Fmedia_attachments%2Ffiles%2F114%2F904%2F691%2F590%2F636%2F603%2Fsmall%2Fc15126759796271a.png)
4 views
These sites are still serving up Pearl Stealer.akwatic-hotel[.]ci
ardiellifornasa[.]ge
bleulab[.]ci
clasoftmedia[.]ci
gtl[.]ci
rafelink[.]life
📊 Post engagement
9
Avg engagement / post
1.8%
Engagement vs followers
Nov 2022
On Mastodon since
🔥 Top post: Stumbled into a supply chain attack yesterday affecting over 100 · 26 likes + reposts
📊 Activity & format
Posting cadence
0.17 / week
A lower-frequency account — each post lands with more weight.
Content mix
Mostly text
Recent: 7 text · 4 image · 1 video.
Follower / following
1.7×
Follows 302 back. A more reciprocal / networked account.
Recent posts
View on Mastodon ↗
i've got a new malware analysis describing what i have dubbed XorBee RATdelivered by #kongtuke via #clickfix Python basedtargets domain-joined Windowsuses port tcp/4444 for C2 trafficobfuscates C2 traffic with XOR of the letter bcontinuous…
they're targeting English and Japanese languages.
▶
we see TOADs coming from web.core.windows[.]net everyday. they all use the same template. yesterday a new template came across from my.id and i thought the sequence with a fake CMD sequence was hilarious.
These sites are still serving up Pearl Stealer.akwatic-hotel[.]ci
ardiellifornasa[.]ge
bleulab[.]ci
clasoftmedia[.]ci
gtl[.]ci
rafelink[.]life
Wrote up an analysis of a perl-based macOS/linux stealer. I wasn't able to find any other references to this, thus the inspiration for the write-up. Decided to give it a name:
Pearl Stealer
https://rmceoin.github.io/malware-analysis/2025…
One less fake browser update campaign. Not to be left out, #SmartApeSG has switched to the #ClickFix technique.
@briankrebs funny you should post yesterday about #ClickFix . I blogged the day prior about a supply chain attack that presented that very threat. It's been a very popular technique with the TA's, many of which have switched from fake br…
Ah! Found the tool used to do this Javascript obfuscation method.
https://benjaminaster.com/invisible-javascript/
Ran into this while digging at a new obfuscation method in use by #Tycoon2FA . The new method uses the following tool by th…
Here's how the PhaaS #Tycoon2FA uses the anti-bot service #BlackTDS.
https://rmceoin.github.io/malware-analysis/2024/12/26/antibot2.html
This traffic happens between a hosted server and the anti-bot service, so in a sense this is potential…
Here's part 1 of 2 describing how PhaaS use anti-bot services to help filter out security services and analysts. This part covers how #Mamba2FA uses #Adspect.
https://rmceoin.github.io/malware-analysis/2024/12/21/antibot1.html
#threatint…
wow. just took on the task of helping somebody get OAuth to work with perl. it seems Google is finally going to banish old school user/pass with POP3/IMAP. it's been years since i've worked with perl.
they're targeting English and Japanese languages.
▶
we see TOADs coming from web.core.windows[.]net everyday. they all use the same template. yesterday a new template came across from my.id and i thought the sequence with a fake CMD sequence was hilarious.
These sites are still serving up Pearl Stealer.akwatic-hotel[.]ci
ardiellifornasa[.]ge
bleulab[.]ci
clasoftmedia[.]ci
gtl[.]ci
rafelink[.]life
Wrote up an analysis of a perl-based macOS/linux stealer. I wasn't able to find any other references to this, thus the inspiration for the write-up. Decided to give it a name:
Pearl Stealer
https://rmceoin.github.io/malware-analysis/2025…
One less fake browser update campaign. Not to be left out, #SmartApeSG has switched to the #ClickFix technique.
@briankrebs funny you should post yesterday about #ClickFix . I blogged the day prior about a supply chain attack that presented that very threat. It's been a very popular technique with the TA's, many of which have switched from fake br…
Ah! Found the tool used to do this Javascript obfuscation method.
https://benjaminaster.com/invisible-javascript/
Ran into this while digging at a new obfuscation method in use by #Tycoon2FA . The new method uses the following tool by th…
Here's how the PhaaS #Tycoon2FA uses the anti-bot service #BlackTDS.
https://rmceoin.github.io/malware-analysis/2024/12/26/antibot2.html
This traffic happens between a hosted server and the anti-bot service, so in a sense this is potential…
Here's part 1 of 2 describing how PhaaS use anti-bot services to help filter out security services and analysts. This part covers how #Mamba2FA uses #Adspect.
https://rmceoin.github.io/malware-analysis/2024/12/21/antibot1.html
#threatint…
wow. just took on the task of helping somebody get OAuth to work with perl. it seems Google is finally going to banish old school user/pass with POP3/IMAP. it's been years since i've worked with perl.
🐘 Community & instance
Home server
infosec.exchange
A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.
✅ Link-verified
Verified link
Proved ownership of a website linked on their profile — Mastodon's green-check verification, a real identity signal rather than a paid badge.
On Mastodon since
Nov 2022
Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.
💡 Facts
🗓️Joined Mastodon in 2022 — 3 years ago.
👁️Averages 9 views per post.
📤Posts about 0.2× per week.
🕵️ Fake follower check
Estimated89/100
Excellent
Credibility score
99%
Real
Real audience
Low
Fake-follower risk
High
Data confidence
- Est. 99% real, active audience · Low fake-follower risk.
- Strong engagement (~1.8% of followers engage each post) — an active, real audience.
- Verified account.
- Established account (3+ years old).
Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.
About
Tech, banjo, guitar, outdoors
#ReverseEngineering #DFIR #ThreatIntel
📸 Gallery
🔀 Audience overlap
EstimatedEstimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.
Anders Stenberg
18%
Avi 🦝
17%
Nurse Mich
17%
stephann :godot: :playdate:
14%
Radical Social Worker
12%
José Manuel Calderón Trilla
12%
More like this
Find more →
Mastodon
stephann :godot: :playdate: ✓
@stephann@mastodon.gamedev.place
512
Followers
Mastodon
Avi 🦝 ✓
@avi@chitter.xyz
512
Followers
Mastodon
Anders Stenberg
@sonnybonds@mastodon.gamedev.place
512
Followers
Mastodon
Radical Social Worker
@radicalsocialworker@veganism.social
512
Followers
Mastodon
José Manuel Calderón Trilla
@jmct@types.pl
512
Followers
Mastodon
Nurse Mich
@nursemich@nerdculture.de
512
Followers
✉ Message Randy
Reaching out to influencers is a Pro feature. Upgrade to message any influencer directly — perfect for brands and agencies booking sponsorships.
- ✓ Message any influencer from their listing
- ✓ The influencer gets notified by email
- ✓ Manage every conversation in one inbox
Already Pro? Log in.
🎤 Event / appearance with Randy
Booking an event / appearance is a Pro feature. Upgrade to book Randy for an in-person or virtual appearance — payment held safely in escrow until the event is done.
- ✓ Book them for events, livestreams, panels & more
- ✓ Randy gets notified by email
- ✓ Fee held in escrow, released after the appearance
Already Pro? Log in.
🚀
You're out of free requests this month
Free accounts get 5 per month. Go Pro for unlimited sponsor pitches, collab requests & sponsorship deals — plus featured placement, the Verified badge, free withdrawals and more.
Upgrade to Pro — $9.95/mo →Your free limit resets on the 1st of next month.