https://personal-website-576.pages.dev/ Recent content on Vitalii Zaiats Hugo en-us Sat, 04 Jul 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/residential-proxy-botnet/ Fri, 26 Jun 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/residential-proxy-botnet/ I got bored on a forum doing arithmetic on ‘millions of residential IPs’, ended up reverse-engineering a botnet’s C2 from one infected phone, and reported it. The whole messy thread — and where it led. https://personal-website-576.pages.dev/posts/wire-air-correlation/ Sat, 04 Jul 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/wire-air-correlation/ A weekend bench experiment: drive a size/timing pattern through a doubly-encrypted, proxied flow and watch it reappear in a device’s WiFi frames. The physics held at r=0.9 on my own hardware — and then the real fight was with a cheap monitor adapter that decoded almost none of the frames I actually needed. A lab notebook that ends in a shopping list, false positive included. https://personal-website-576.pages.dev/posts/chaining-socks5-udp-relays/ Sat, 13 Jun 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/chaining-socks5-udp-relays/ Final follow-up post debunking the “open UDP relay = DDoS amplifier” fear: chaining launders origin but de-amplifies at the target, self-looping only DoSes the relay itself, loopback forwarding is a UDP SSRF, and even a paid commercial proxy fails the RFC 1928 §6 source check — every behavior reframed as a single-packet detection fingerprint. https://personal-website-576.pages.dev/posts/socks5-udp-open-relays/ Thu, 11 Jun 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/socks5-udp-open-relays/ Final version of the SOCKS5 open-UDP-relay teardown: de-quantified the scan-list phrasing, aligned a log comment to first-person voice, and thinned one forward-reference scaffold, with all tables, numbers, RFC references, and the “signals, not weapons” defensive framing preserved verbatim. https://personal-website-576.pages.dev/posts/from-torrent-to-boobytrapped-game/ Sun, 31 May 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/from-torrent-to-boobytrapped-game/ I chased a residential proxy pool’s own download habits down to one cracked driving game, and found a build that’s a confirmed ad-fraud carrier hiding an encrypted payload I still can’t prove is proxyware. https://personal-website-576.pages.dev/posts/coordinated-disclosure-cctv-proxies/ Wed, 15 Apr 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/coordinated-disclosure-cctv-proxies/ How I passively fingerprinted hacked Dutch CCTV cameras being resold as residential proxy exit nodes — and reported them to NCSC-NL without ever touching a single box. https://personal-website-576.pages.dev/posts/the-ios-proxy-ghost/ Fri, 03 Apr 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/the-ios-proxy-ghost/ Turns out the iPhone on every proxy provider’s landing page is the one device that basically can’t be in the pool — and that absence is exactly what makes a real iOS fingerprint a trustworthy “human here” signal. https://personal-website-576.pages.dev/posts/tcp-fingerprinting-residential-proxies/ Thu, 26 Mar 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/tcp-fingerprinting-residential-proxies/ Probed 319,706 residential-proxy exits by their TCP SYN fingerprints — 98% Linux, two kernel defaults covering 70%+, MSS leaking the real link, and a handful of big ISPs — showing the “real user devices” are mostly a rack of Linux boxes. https://personal-website-576.pages.dev/posts/detecting-credential-stuffing-through-tls/ Tue, 24 Mar 2026 00:00:00 +0000 https://personal-website-576.pages.dev/posts/detecting-credential-stuffing-through-tls/ Encrypted traffic still leaks its silhouette: near-identical response sizes (CV < 0.05) plus JA3 counts turn a sealed TLS tunnel into a credential-stuffing detector. https://personal-website-576.pages.dev/about/ Mon, 01 Jan 0001 00:00:00 +0000 https://personal-website-576.pages.dev/about/ Who I am and what I work on.