Learn
Learn
Plain explanations of the threats SphereTI monitors — what each one is, how it reaches an organisation, and what actually detects it.
Showing 1–9 of 18 articles
Dark-Web
How Stolen Credentials Are Traded on Telegram
Public channels advertise, private channels deliver, and Telegram's own policy explains why. The split is architecture, not accident.
Read
Dark-Web
Ransomware Data Leak Sites
The public victim counts everyone quotes are wrong in both directions at once, and nothing about the data's generating process is neutral.
Read
Credential exposure
Combolist Breach: What to Do Next
The count is inflated and the data is recycled. The question that matters is where it came from, not how much of it there is.
Read
Brand protection
Why DMARC Does Not Stop Business Email Compromise
The specification names the attacks people buy DMARC to stop and puts them out of scope. The requirements that drove adoption accept a policy that enforces nothing.
Read
Dark-Web
Dark Web vs Deep Web: What's the Difference?
The author of the famous 96 percent figure has disowned it. What the measured numbers actually show.
Read
Deception
What Are Canary Tokens?
High precision detection bought with unknowable recall. The trade is worth understanding before you deploy any.
Read
Brand protection
What Is Business Email Compromise?
Most of it arrives from a Gmail account with the right name on it. There is no protocol that stops that.
Read
Credential theft
How Attackers Bypass MFA
Most MFA bypass does not attack MFA. It waits until the authentication is over and takes the result.
Read
Credential theft
What Is Credential Stuffing?
One attempt against a million accounts, not a million attempts against one. That shape is why the usual defences miss it.
Read