Cyber threat research

Who is targeted, how attacks work, and what changed.

Citable public-safe studies that combine PhishNet observations with kit behavior, campaign mechanics, Belgian sector pressure, European comparison and practical implications.

Quarterly reportAll studiesRSS
Flagship studies

Research built to answer a decision, not fill a feed.

Long-form analysis combines measured observations with attacker behavior, European comparison, operational implications and a citable method.

Quarterly landscapeBelgium’s phishing pressure, explained

Sector movement, kit reuse, cross-border infrastructure and what changed from the previous quarter.

Read the study → Benelux field studySmishing routes and the cash-out path

How message delivery, landing infrastructure and mule behavior connect across the victim journey.

Read the study → Kit intelligenceWhat attackers reuse after takedown

DOM, script, favicon, form-action and operator mistakes that survive individual domains.

Read the study → Identity threatMicrosoft 365 and AiTM kit families

Campaign mechanics, session theft, evidence signals and the controls that change the outcome.

Read the study → Brand exposureWhy Belgian harm is not confined to .be

Language, trust, redirect and payment-route signals that reveal local relevance across global infrastructure.

Read the study → Research libraryExplore the complete knowledge base

More than daily notes: methods, field observations, campaign studies, regulatory analysis and technical explainers.

Open all research →
Our analytical standard

Every study earns its conclusion.

What changed?Measured movement against a previous cut, not a floating total.
Why does it matter?Customer harm, operational impact, sector context and regulatory relevance.
How do we know?Source families, confidence, timestamps, limitations and redacted examples.
What should happen next?Concrete implications for detection, warning, evidence, takedown or reporting.
Opening published research.