I put up a free public CertStream endpoint for anyone monitoring phishing or lookalike domains

wss://api.certstream.dev/

No API key or signup needed, just connect over WebSocket

Python example: https://certstream.dev/free-certstream-api.html

Open source: https://github.com/reloading01/certstream-server-rust

Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

- Google's own nameserver vouched for Russian IPs as Googlebot.

- One PTR addresses AI agents directly, and it passes forward confirmation.

- The exfil payload dodges filters for spaces, parentheses and quotes, and phones home to an IP written as one decimal number.