u/tuxxin

When you're coming up with a new idea, do you think outside the box or stick with what you're comfortable with? I feel since AI, if your site doesn't stick out in some way it's difficult to gain traction.

What's the coolest/most different project you've put out?

For me, it's been dual-interface websites so the website is fully functional GUI (browser) or curl (terminal).

When you're coming up with a new idea, do you think outside the box or stick with what you're comfortable with? I feel since AI, if your site doesn't stick out in some way it's difficult to gain traction.

What's the coolest/most different project you've put out?

For me, it's been dual-interface websites so the website is fully functional GUI (browser) or curl (terminal).

When you're coming up with a new idea, do you think outside the box or stick with what you're comfortable with? I feel since AI, if your site doesn't stick out in some way it's difficult to gain traction.

What's the coolest/most different project you've put out?

For me, it's been dual-interface websites so the website is fully functional GUI (browser) or curl (terminal).

When you're investigating a known malicious URL, how often does your URL scanner (regardless of service) miss the payload due to traffic distribution systems?

I built qsa.sh to give you an instant, outside-in security scan of your own public IP straight from your terminal.

You can run it like this:

curl qsa.sh

What it does: It triggers a real external port and vulnerability scan (using open-source tools like naabu, nmap + vulners, and nuclei) of the public IP you're connecting from, streamed live back to your terminal in about 30 seconds.

How it handles safety & consent:

Only your IP: There is no target input field. You cannot point it at anyone else.

The 15-second abort window: When you run the command, it prints your detected IP and gives you a 15-second grace period (Ctrl-C) to abort before anything is actually scanned.

Refusals: Known CGNAT, mobile-carrier, and detected VPN/Tor/IPv6 origins are refused outright.

Zero retention: The results are entirely ephemeral and streamed live—nothing is written to disk.

Curious to hear what people think.

Traffic Direction Systems (TDS) have become a massive headache for analysts. By fingerprinting IPs, attackers can dynamically route traffic—hiding malicious payloads from security tools while successfully targeting residential, mobile, or specific ASNs.

The problem? Almost every URL scanner out there uses datacenter-based egress IPs. Attackers know this, so they block or cloak against datacenter ranges.

I ran into this wall while investigating malware distributed via a lapsed corporate domain. The standard scanners were returning clean results or blocked pages, but my home connection was still being served malware. Doing the analysis manually was a massive bottleneck, so I built the tool.

What it does: Whack allows you to scan any URL simultaneously through multiple egress options: Datacenter, Residential, Mobile, VPN, and even BYO IP. It then diffs the captures (HAR files) to expose the cloaking, TDS routing, phishing, and malware that traditional datacenter-only scanners miss.

The Origin & Investigation: I’ve been working on this for over a month and have already run over 150,000 scans of known threat URLs. The early MVP was basic but proved the concept: diffing HAR files of the exact same URL across different categorized ASNs immediately exposed the evasion tactics.

I actually reported my initial findings on this specific threat to the FBI IC3 on Monday, June 15th. Three days later, IC3 pushed out a PSA specifically regarding TDS. (I’ll be publishing a few in-depth articles on my company's site detailing these findings in the coming weeks).

Under the Hood (TDS-over-TDS): One of the most interesting things the tool exposed during this process is that TDS isn't just happening at the redirect layer. I found several instances of TDS-over-TDS (redirect layer + payload delivery layer). Malicious actors are using real-time API calls or compressed local IP intelligence to serve entirely different payloads based on the exact environment (e.g., Windows vs. Mobile/Android/Chrome vs. Mobile/iOS/Safari).

Community Integration: I want this data to be useful to the broader community, so any threats found by whack.sh are automatically published to Abuse.ch:https://bazaar.abuse.ch/user/42023/

I’m putting the final polish on the site and planning to officially launch on or before August 4th. In the meantime, I would love to hear your thoughts on the concept! What features would you want to see, or what specific evasion tactics would you want to test against it when it goes live?

Since my other site I posted today did so well I figured I'd share this one too. This site actually gave me the idea for Overwatch.earth. Yes, this one will likely become a SaaS in time due to the operating costs but as it stands now it's completely free.

WorldIP.io - The complete IPv4 address space, mapped