Top all-time · #8211
Dancho Danchev
Personal blog · ddanchev.blogspot.comsecurity
Dancho Danchev's personal blog at ddanchev.blogspot.com covers security. Since 2008, 10 different Hacker News readers have linked it 16 times. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Dancho Danchev's blog as a source of malware and cybercrime analysis, such as the Koobface worm, Stuxnet and Russian-run anonymous services. Comments cite specific posts as background.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Dancho Danchev's Blog - Insightful and independent open-source intelligence (OSINT) analyses cybercrime research and threat intelligence gathering
Most-linked posts?
- /3 people · 3 mentions · first linked 2011-01-15
What Hacker News says?
Changing my vote. I think the guy is nuts and/or running away. Stuff doesn't add up. -He claims a particular LEO is after him for pro-western views. This is the hardest hit to his credibility. If he said that botnet authors came after him for outing them, that might be plausible. The Belgian government does not hunt and 'disappear' pro-western people. -There is no stego in this image like some have suggested. If it…
Comment linking /
on “Malware researcher Dancho Danchev gone missing since August”Submitted Who's behind the Koobface botnet? as a story · 5 points
HN discussionNot to take anything away from Brian, but I'd say the online crime world's hatred of Dancho Danchev is probably right up there, if not more. He has blogged[1] almost consistently about different malware campaigns, and for awhile was actually thought to be kidnapped[2]. [1] http://ddanchev.blogspot.com/ [2] http://techcrunch.com/2011/01/21/great-news-missing-cybersec...
Comment linking /
on “Reporting From the Web’s Underbelly”Submitted Dancho Danchev: Summarizing 3 Years of Research Into Cyber Jihad as a story · 5 points
HN discussion"Anyone have any ideas how to find them?" Follow the malware. Dan Danchev [1] used to be quite forthcoming with his analysis until he wasn't anymore. If you set up a malware aquarium [2] you can see the C&C servers these things use. Although not all malware reproduces in captivity. [1] http://ddanchev.blogspot.com/2013/02/dissecting-nbcs-exploit... [2] https://www.xkcd.com/350/
Comment linking /2013/02/dissecting-nbcs-exploits-and-malware.html
on “Stuxnet Missing Link Found, Resolves Some Mysteries Around the Cyberweapon”Submitted Massive IFRAME SEO Poisoning Attack Continuing as a story · 1 points
HN discussionRelevant links: http://ddanchev.blogspot.com/2012/01/whos-behind-koobface-bo... http://nakedsecurity.sophos.com/koobface/
Comment linking /2012/01/whos-behind-koobface-botnet-osint.html
on “Koobface Gang Uses Facebook to Spread Powerful Worm”Submitted Mujahideen Secrets 2 Encryption Tool Released as a story · 1 points
HN discussionThis is almost certainly related to some sort of Russian cybercrime investigation. If you ever read Krebs or peruse some of the seedier Russian forums, xmpp.ru will sound familiar to you, because it is. Not imputing anything to the operator, that's just the nature of operating an anonymous service. https://ddanchev.blogspot.com/2021/03/exposing-currently-act... https://ddanchev.blogspot.com/2019/07/profiling-current…
Comment linking /2019/07/profiling-currently-active-portfolio-of.html
on “Encrypted traffic interception on Hetzner and Linode targeting Jabber service”some mentions about those - http://ddanchev.blogspot.com/2007/07/icepack-malware-kit-in-... http://ddanchev.blogspot.com/2007/06/mpack-kit-attack-on-vid... http://ddanchev.blogspot.com/2007/06/massive-embedded-web-at... http://ddanchev.blogspot.com/2009/04/inside-zeus-crimeware-d... http://ddanchev.blogspot.com/2008/12/zeus-crimeware-as-servi...
Comment linking /2008/12/zeus-crimeware-as-service-going.html
on “Source codes of infamous MPack, IcePack and Zeus and other botnet kits.”Just because the soviet union did something doesn't mean that's what's happening here. Look at the facts... 1. Mr. Danchev took pictures to "prove" his apartment was bugged ( http://www.zdnet.com/blog/security/we-need-help-with-the-str... ) yet the pictures prove no such thing ( http://news.ycombinator.com/item?id=2106735 ) Some have speculated the two cables underneath MIGHT power a bug but I consider that unlikely…
Comment linking /
on “Tell HN: IT security expert Dancho Danchev is placed in a psychiatric hospital”