⚖️Disclaimer & Methodology

1. Nature of publications

The threat intelligence dossiers published on this site are analytical assessments and opinions — not legal findings, not judicial determinations, and not accusations of criminal conduct.

Conclusions presented herein may be wrong. They represent the best interpretation of available evidence at the time of publication and may be revised, retracted, or superseded as new information becomes available.

Confidence levels (HIGH, MEDIUM, LOW) are explicitly stated for each major claim. Where sources disagree, the disagreement is documented rather than hidden.

2. Personal-capacity disclaimer

The research, views, and opinions expressed on shuffle-on.com are entirely my own. They do not reflect the official policies, positions, or opinions of my employer, Digital Science, or any of its affiliates.

Everything on this site is published in my personal capacity, on my own time, on my own infrastructure. No employer resources, data, or systems are used or referenced.

3. Data collection pipeline

All investigations follow a consistent 6-step pipeline:

• Step 1 — Passive capture: SSH honeypot (Cowrie) records all inbound connection attempts, credentials, commands, and payloads. No scanning, no active engagement of victims.
• Step 2 — Automated enrichment: IPs are enriched from 12+ OSINT sources (RDAP, AbuseIPDB, Shodan, GreyNoise, OTX, VirusTotal, Censys, PeeringDB, etc.).
• Step 3 — Correlation: Entity-linking algorithms detect shared SSH keys, shared malware, temporal coordination, and credential clustering.
• Step 4 — Investigation: Patterns that cross a significance threshold are promoted to formal investigations with structured evidence collection.
• Step 5 — Research: Institutional anchors are identified — RIR records, corporate registrations, government contracts, sanctions filings, court documents.
• Step 6 — Publication: Findings are written up with full source citations, confidence calibration, and alternative hypotheses addressed.

4. AI-assisted research

This research uses large language models (LLMs) as research assistants. Since autumn 2026 the analysis runs on local, open-weight models on the author's own hardware; no investigation data is sent to a cloud AI service for analysis. Specifically:

• What AI does: Summarizes large document sets, identifies patterns in structured data, drafts prose from structured findings, suggests alternative hypotheses, performs bulk data lookups, and proposes leads for review.
• What AI does NOT do: Make attribution decisions, assign confidence levels, determine what to investigate, choose what to publish, or override human judgment on any factual claim. An investigation agent may propose; nothing is published without a human decision.

Every factual claim in a published dossier traces back to a verifiable source (captured traffic, public record, OSINT platform). The AI assists in finding and organizing evidence — it does not fabricate it.

All editorial decisions, conclusions, and responsibility for accuracy rest solely with the human author.

5. Source hierarchy

Evidence is weighted by reliability tier:

• TIER 1 Direct observation — captured traffic, recorded sessions, file hashes from honeypot
• TIER 2 Authoritative records — RIR databases (RIPE, APNIC, ARIN), court filings, regulatory disclosures, corporate registries
• TIER 3 Community intelligence — AbuseIPDB reports, OTX pulses, GreyNoise tags, PeeringDB profiles, Shodan banners
• TIER 4 Contextual — news reports, blog posts, Wikipedia, industry commentary (used for context only, never as sole basis for claims)

6. Limitations acknowledged

• Observational bias: The honeypot only sees what attacks it. Absence of evidence is not evidence of absence.
• IP attribution imperfection: IPs can be spoofed, VPNed, or proxied. ASN-level attribution is more reliable than individual IP attribution.
• Single researcher: This work does not benefit from institutional peer review. Errors may persist longer than they would in a team environment.
• No legal review: Publications are not reviewed by legal counsel prior to publication.
• Temporal decay: Infrastructure changes. Findings reflect the state at the time of investigation and may not reflect current conditions.

7. Factual corrections

If you identify a factual error in any published material — a misattributed IP, an incorrect organization name, a wrong date — please contact me at lisneanucristian@shuffle-on.com or lisneanucristian@gmail.com for correction.

Documented corrections will be applied promptly and will leave a visible audit trail in the affected post or dossier. Corrections strengthen the work; they are welcome.

8. Named-entity policy

Where commercial entities or threat actors are named, the naming is supported by publicly verifiable evidence (registration records, captured traffic, signed documents, court filings, regulatory disclosures).

Such material is published under the standard journalistic principle of accurate reporting in the public interest. The purpose is to document observable patterns in internet infrastructure — not to defame individuals or organizations.

Subjects of any publication who believe the material is materially incorrect are encouraged to contact the corrections email above. Good-faith factual corrections will be applied regardless of the source.

9. Data protection & GDPR legal basis

This research processes IP addresses (personal data under GDPR) and, in some cases, names of individuals associated with corporate registrations or public records. The legal bases for this processing are:

• Article 6(1)(f) — Legitimate interest: The security of information systems constitutes a recognized legitimate interest (Recital 49 GDPR). Processing attacker IPs that target personal infrastructure is necessary for network security.
• Article 85 — Journalistic and academic exemption: This research is conducted for journalistic purposes (documenting threats to internet infrastructure in the public interest) and benefits from the derogations provided by EU member states under Art. 85(2).
• Romanian Law 190/2018, Art. 7: Romania's GDPR implementation provides specific exemptions for journalistic, academic, artistic, and literary expression, including exemption from the right to erasure where processing serves the public interest.

References: GDPR Recital 49, Art. 6(1)(f), Art. 85(2), Art. 17(3)(a); Romanian Law 190/2018 Art. 7

10. Data subject rights

If you believe your personal data (e.g., an IP address registered to you) appears in a published investigation, you may contact lisneanucristian@shuffle-on.com or lisneanucristian@gmail.com to:

• Request information about what data is held (Art. 15 GDPR)
• Request rectification of inaccurate data (Art. 16 GDPR)
• Object to processing (Art. 21 GDPR)

However, please note that the right to erasure (Art. 17) is limited where processing is necessary for exercising the right of freedom of expression and information (Art. 17(3)(a)), for reasons of public interest in the area of public health and security, or for archiving purposes in the public interest / scientific research (Art. 17(3)(d)).

Each request will be assessed individually. Legitimate corrections are always applied; requests to suppress accurate, publicly-sourced information about malicious infrastructure will generally be declined.

11. Active reconnaissance disclosure

In some cases, IP addresses that have attacked this infrastructure are subsequently scanned to determine what services they expose. This counter-reconnaissance is:

• Conducted only against IPs that first initiated unauthorized access attempts against the honeypot
• Limited to port scanning and service fingerprinting (non-destructive, read-only operations)
• Routed through anonymization infrastructure to prevent attribution back to personal systems
• Used solely to enrich threat intelligence (e.g., identifying shared infrastructure patterns)

No exploitation, data extraction, denial of service, or modification of remote systems is performed. This is analogous to checking if a burglar's vehicle has visible license plates — observational, not interventional.

12. Non-commercial research — and separate professional work

The threat-intelligence research on this site (dossiers, live feeds, honeypot and defense reports) is published without any commercial purpose:

• No advertising, sponsorship, or affiliate revenue is generated
• No data is sold to third parties
• No paid subscriptions or paywalls exist
• No dossier is commissioned, paid for, written for a client, or altered at anyone's request — corrections follow section 7 only
• The infrastructure is self-funded and self-hosted; voluntary donations (see the support page) only help cover hardware and electricity and buy no influence over what is published

Separately, the author offers engineering services (for example private AI, knowledge systems, platform and security engineering) built on the same skills. Such work is done under its own written agreements and never involves selling, sharing, or tailoring the published research or the data behind it.

The purpose of the research itself remains contribution to public knowledge about internet security threats. Its non-commercial nature is relevant to both GDPR legitimate-interest balancing and to defamation-law assessments of intent.

13. Jurisdiction & governing law

This website is operated from Iași, Romania, within the European Union. Any dispute arising from or relating to the content published on this site shall be governed by Romanian law and subject to the exclusive jurisdiction of the courts of Iași, Romania.

The author is a natural person domiciled in Romania and benefits from the protections afforded by:

• The Romanian Constitution, Art. 30 — Freedom of expression
• The European Convention on Human Rights, Art. 10 — Freedom of expression
• EU Charter of Fundamental Rights, Art. 11 — Freedom of expression and information
• Romanian Civil Code, Art. 70-77 — Right to free expression, defense of legitimate public interest

Applicable law: Romanian Civil Code; ECHR Art. 10; EU Charter Art. 11; Romanian Constitution Art. 30

14. Quotation & fair use

Published investigations may quote or reference material from third-party sources (news articles, court filings, corporate disclosures, academic papers). Such use is made under:

• Romanian Copyright Law (Law 8/1996), Art. 33: Right of quotation for purposes of criticism, commentary, and review
• EU Directive 2019/790, Art. 15: Press publishers' rights do not apply to individual words, short extracts, or hyperlinking
• Berne Convention, Art. 10: Quotation compatible with fair practice for criticism and review

All quoted material is attributed to its source. No full reproduction of copyrighted works is made. Quotation is limited to what is necessary to support the analytical point being made.

15. External links & third-party content

This site contains links to external websites and resources (OSINT platforms, news outlets, public registries, academic papers). These links are provided for source verification purposes.

The author:

• Does not control or endorse the content of linked external sites
• Is not responsible for the availability or accuracy of external content
• Cannot guarantee that linked content will remain accessible (archival references are used where possible)
• Provides links in good faith as citations supporting published claims

16. Visitor data & server logs

This site uses no cookies for tracking, no analytics and no third-party trackers. Some pages load web fonts from Google Fonts, which receives your IP address when it serves them.

Like any web server, this infrastructure records technical request data (IP address, time, requested path, user agent, response). Because the site is itself a security sensor, these records are also classified automatically to detect hostile traffic. Legal basis: legitimate interest in the security of the infrastructure (GDPR Art. 6(1)(f), Recital 49).

• Raw server logs are kept for up to 90 days, then deleted.
• Automatic block decisions are time-limited; expired decision records are purged after 14 days.
• Addresses involved in hostile activity (scanning, credential attacks, exploitation attempts) may be retained longer, aggregated and enriched, as threat intelligence under sections 9–10.

Automated defenses can occasionally block a legitimate visitor. If that happens to you, write to lisneanucristian@shuffle-on.com or lisneanucristian@gmail.com and it will be reviewed and lifted.

17. The library & machine-generated content

The library described on this site is a private collection, curated over many years for personal research and study. It is not offered for public download through this site; access to its tools is personal and by invitation.

Public pages show only statistics, system descriptions and examples taken from public-domain or openly published works. Rights holders who have a concern about any material may contact lisneanucristian@shuffle-on.com or lisneanucristian@gmail.com and will receive a prompt answer.

Summaries, study guides, extracted entities and OCR text are produced by language and vision models. They are helpful but can contain errors or omissions; the original document remains the authority. Examples marked as illustrations on this site show how a feature works and are not records of real events.

18. Live data & project pages — no warranty

Figures on this site are generated automatically from the running systems every 15–30 minutes. They can be temporarily incomplete, delayed or wrong; attacker addresses are masked on the pages. Machine-readable feeds carry their own license (see the license).

Pages describing projects (the library, the AI agent, the intelligence platform, the classroom and others) describe private systems. They are not offers of software for sale, and everything on this site is provided “as is”, without warranty of any kind. Price comparisons are estimates from public sources and may be out of date.

19. Trademarks

Product and company names mentioned on this site (for example in comparisons or technical descriptions) are trademarks of their respective owners and are used only to identify them. No affiliation or endorsement is implied.

20. Changes to this page

This page is updated when the site or its methods change. The date below shows the latest revision; material changes are reflected here before or when they take effect.