How the research is done

What this publication is for, the standards each report is held to, and what to do if something is wrong.

Who: I'm Samuel Moloney, a software developer in Bendigo, Victoria studying a Certificate IV in Cyber Security. I write up investigations under my own name so the work can be checked, cited and corrected. My development background is on the rest of this site.
Purpose: To publish evidence-based investigations of suspicious files, phishing campaigns, attack techniques and defensive measures, and to build a body of work that shows how I reason about security problems. Reports are written for other practitioners and students, not as marketing.
Evidence: Every report separates four things: confirmed observations (what was directly seen and can be reproduced), reasonable interpretations (what the observations most likely mean), hypotheses (explanations that fit but were not tested), and unverified claims (reported by others and not independently checked). A suspicious file is not described as malware unless the behaviour supports it. Confidence is stated rather than implied.
Responsible disclosure: Vulnerabilities in third-party software or services are reported to the vendor or operator first and given a reasonable window before anything is published. Where a vendor has a disclosure policy, it is followed. Reports about active campaigns avoid giving operators a playbook: enough detail to defend, not enough to replicate harm.
Sensitive material: Live credentials, private personal data and working malicious samples are never published. Indicators such as domains and URLs are defanged (for example hxxp://example[.]com) so they cannot be clicked by accident. Screenshots are redacted where they would expose a victim, an employee or an unrelated third party.
Limitations: Analysis is done in controlled environments with the tools and time available to an individual researcher. Samples change, infrastructure moves and attribution is hard. Each report includes a limitations section that says what was not tested and what remains uncertain.
Corrections: If a report is wrong, it is corrected and the change is noted in the report with the date, rather than silently edited or removed. Material corrections update the "last updated" date. To report an error or supply additional evidence, email s.x.moloney@gmail.com with the report title or number in the subject.
Independence: No report is sponsored, and no vendor or employer reviews them before publication. Where I have a relationship with a product or organisation mentioned, it is stated.

Standard disclaimers

These notices appear at the end of reports. The first is used on formal investigations, the second on general technical research.