Articles and case studies
Notes from practice: server administration, information security, incident investigations and automation.
Plesk on shared hosting: an admin's cheat sheet
Years in hosting support mean hundreds of Plesk servers and the same problems over and over: the disk is full, the mail queue is clogged, a backup hangs, a site returns 503. I collected the commands from my notes into one cheat sheet.
Read article →
How I organized my notes in Obsidian: PARA with an inbox
I never kept a blog — I kept Obsidian. Almost five thousand notes over several years: from my first Linux cheat sheets to SOC work and my own bug bounty platform. Here's how the vault is organized so it doesn't drown me.
Read article →
A second brain with AI: Claude, NotebookLM and Obsidian working together
Five thousand notes is a lot, but I'm still the one who has to read them. A combination of an agent, NotebookLM and Obsidian turns the vault into a 'second brain' that sorts the inbox, remembers context and answers from my own knowledge base.
Read article →
Cutting AI agent costs: a full scan for $1 instead of a $200 subscription
Agents can easily eat hundreds of dollars a month. The principles that brought a full Qyran scan down to about a dollar: code instead of tokens, the right model for the task, short context and a hard budget.
Read article →
A local LLM: Ollama + Open WebUI on your own server
Your own ChatGPT without the cloud: Ollama runs models on your server, Open WebUI provides a familiar chat. Installation, choosing a model for your hardware and, most importantly, how not to expose the model to the internet.
Read article →
Qyran: how I built my own AI-assisted bug bounty and audit platform
From a Bash script to a ~150k-line platform: why manual recon doesn't scale, how ten years of notes turned into 120+ AI skills, and how the recon pipeline, proxy, target scoring and autonomous AI agents work.
Read article →
SIEM noise: from millions of alerts to an incident queue
A snapshot of a real SIEM at a hosting company: millions of alerts a day, three rules producing almost 90% of the volume, and 'critical' alerts that are almost entirely noise. How to live with it and what to tune.
Read article →
Investigating a corporate email compromise: silent forwarding and BEC
Three mailboxes, a week of unnoticed access, a hidden forwarding rule and groundwork for BEC fraud. How to reconstruct an attack from mail server logs.
Read article →
Active Directory by CIS Benchmark: how I built and hardened a domain from scratch
OU structure, order in group policies, CIS Level 1 hardening, LAPS, AppLocker, BitLocker and regular domain audits. What worked and what I had to redo.
Read article →
Building a SOC on Wazuh from scratch: a fault-tolerant cluster for 300+ agents
Cluster architecture, agent load balancing, securing the SOC itself, integrations — and the main pain of any SIEM: alert noise. Lessons from a rollout at a hosting company.
Read article →
Migrating customer mail: imapsync-manager
Mail migration is a frequent task at a hosting company and a frequent source of complaints. How I automated bulk mailbox migration on top of imapsync and checking that everything arrived.
Read article →
http2shell: an HTTP API in pure Bash
A lightweight HTTP API server on Bash and socat with no frameworks. It was born from n8n's limit on command output size — and turned out useful for automation, labs and CTFs.
Read article →
ReconWTF: my recon tool for bug bounty
One command and dozens of recon tools run in a chain: subdomains, endpoints, JavaScript, ports, technologies and vulnerabilities. Why I wrote my own tool and how it works.
Read article →
Protecting hosting from bots: CrowdSec, BitNinja and Imunify360 in practice
Three tools I've worked with on hosting servers: where each one shines, how to use them in everyday support and which pitfalls wait during rollout.
Read article →
Suricata + ELK: your own network IDS with dashboards
An open-source network IDS: Suricata watches the traffic, suricata-update keeps rules fresh, Kibana and EveBox show the alerts, and Wazuh ties network events to host events.
Read article →
Investigating a phishing email with OSINT, step by step
From a suspicious email to indicators of compromise: headers, SPF/DKIM/DMARC, safe link analysis, OSINT on the infrastructure and what to do next.
Read article →
Cheat sheet: how to investigate a hacked website and server
Preserve evidence first, analyze second, remediate third. A step-by-step order of actions and ready-to-run commands for investigating a hacked website on a Linux server.
Read article →
Case study: a site crashes every time a post is saved — from Apache to MySQL
Every time an editor saved a post, the server went into a tailspin: hundreds of Apache processes, 504s and only a hard reboot helped. The CMS developers said 'not our problem'. Here's how we traced the chain from nginx to MySQL and what fixed it.
Read article →