RyanDFIR✓ Add us as a preferred source on Google

Mastodon @ryandfir@infosec.exchange

⚔ Compare ☆ Follow Own this channel?

🔄 Data last refreshed 1 month ago

🤝

Make a deal with RyanDFIR

🔒 Paid proposals held safely in escrow — released only when the work's approved.

Followers

385

Account age

3 yrs

🎁 Free analysisfor RyanDFIR

🕵️Fake Followers CheckReal-audience % & bot risk→ 📊Engagement rateBenchmarked vs. peers→ 💰What they chargeFair sponsored-post price→

Known for

..and there's another Unfurl release as well! v2025.03 is live and adds new features and some fixes, including:
🔎 Parsing #Google Search's UDM parameter
🐘 Recognizing #Mastodon usernames and parsing Mastodon forks (like truthsocial[.]com and gab[.]com)
🧹 Utility parser to "clean up" inputs
Try it out at https://unfurl.link or read more about the update https://dfir.blog/unfurl-parses-googe-udm-and

8 views ..and there's another Unfurl release as well! v2025.03 is live and adds new features and some fixes, including: 🔎 Parsing #Google Search's UDM parameter 🐘 Recognizing #Mastodon usernames and parsing Mastodon forks (like truthsocial[.]com and gab[.]com) 🧹 Utility parser to "clean up" inputs Try it out at https://unfurl.link or read more about the update https://dfir.blog/unfurl-parses-googe-udm-and

Unfurl can parse JSON Web Tokens!
At the highest level, JWTs have three parts: header, payload, and signature. Unfurl first splits a #JWT into those three components, then base64-decodes the header and payload, then parses the resulting JSON objects. While Unfurl could parse all that in one step, it does it in three steps to keep with the "show your work" spirit of the tool.
Here's an example: htt

7 views Unfurl can parse JSON Web Tokens! At the highest level, JWTs have three parts: header, payload, and signature. Unfurl first splits a #JWT into those three components, then base64-decodes the header and payload, then parses the resulting JSON objects. While Unfurl could parse all that in one step, it does it in three steps to keep with the "show your work" spirit of the tool. Here's an example: htt

Have a big number (or hex value) you found and think might be a timestamp? Drop it in `unfurl` in the terminal and see what comes out!
(add -d or --detailed if you want the type of timestamp, or run without it if you just want the value)
#DFIR #BF4SA #Unfurl 🌿

4 views Have a big number (or hex value) you found and think might be a timestamp? Drop it in `unfurl` in the terminal and see what comes out! (add -d or --detailed if you want the type of timestamp, or run without it if you just want the value) #DFIR #BF4SA #Unfurl 🌿

A new Unfurl release is here! v2025.02 adds:
🌐 Parsing encoded/obfuscated IP addresses
🦋 Resolving #Bluesky handles to their identifiers (DIDs) and looking up their creation timestamps
🐛 Bug fixes & better bulk parsing
Blog: https://dfir.blog/unfurl-parses-obfuscated-ip-addresses/
Code: https://github.com/obsidianforensics/unfurl
#DFIR #OSINT

4 views A new Unfurl release is here! v2025.02 adds: 🌐 Parsing encoded/obfuscated IP addresses 🦋 Resolving #Bluesky handles to their identifiers (DIDs) and looking up their creation timestamps 🐛 Bug fixes & better bulk parsing Blog: https://dfir.blog/unfurl-parses-obfuscated-ip-addresses/ Code: https://github.com/obsidianforensics/unfurl #DFIR #OSINT

📊 Post engagement

📊 Activity & format

Posting cadence

0.08 / week

A lower-frequency account — each post lands with more weight.

Content mix

Mostly images

Recent: 5 text · 6 image · 1 video.

Follower / following

1.2×

Follows 313 back. A more reciprocal / networked account.

Recent posts

View on Mastodon ↗

🔥 Top post ..and there's another Unfurl release as well! v2025.03 is live and adds new features and some fixes, including: 🔎 Parsing #Google Search's UDM parameter 🐘 Recognizing #Mastodon usernames and parsing Mastodon forks (like truthsocial[.]com and gab[.]com) 🧹 Utility parser to "clean… ★ 8

dfir[.]blog is now Hindsight Foundry (hindsig.ht): a site dedicated to browser forensics research, open source tools, and related resources. https://hindsig.ht/blog/introducing-hindsight-foundry/

There's a new Hindsight release! New features in v2026.04 include: - Parsing of Sessions_* and Tabs_* files (SNSS) into both the Timeline and a dedicated "Sessions" tab in the XLSX output - Parsing of Platform Notifications (including when… ★ 1

▶ Have a big number (or hex value) you found and think might be a timestamp? Drop it in `unfurl` in the terminal and see what comes out! (add -d or --detailed if you want the type of timestamp, or run without it if you just want the value) … ★ 4 A new Unfurl release (https://unfurl.link) is here! v2025.08 brings: 🆔 Parsing more out of a TikTok ID The parser now extracts milliseconds (instead of just seconds), entity type (user account, device, live session, or video), sequence num… There's a new Hindsight release! Hindsight v2025.03 focuses on Extensions - parsing more activity and state records, highlighting Extension permissions, and making it easier to examine Manifests. 🌐 Blog: https://dfir.blog/hindsight-parses…

A new Unfurl release is here! v2025.02 adds: 🌐 Parsing encoded/obfuscated IP addresses 🦋 Resolving #Bluesky handles to their identifiers (DIDs) and looking up their creation timestamps 🐛 Bug fixes & better bulk parsing Blog: https://dfir.b… ★ 4

Over the winter holiday, I was watching Netflix's Carry-On and got a bit nerd-sniped by a real Google Search URL on-screen... and then proceeded to "authenticate" it. https://dfir.blog/authenticating-screenshots-from-netflix-carry-on-movi… ★ 3 There's a new Hindsight release! v2024.10 adds: - Parsing of the DIPS (Detect Incidental Party State) database - Parsing of IndexedDB records - Moving to using more of Alex Caithness' ccl_chromium_reader library behind the scenes (startin… ★ 2 After waking up at 3:19am this morning to a test earthquake alert (7 hours earlier than planned), my first thought was "timezones are hard." Glad to know this holds true outside #DFIR as well lol. ★ 2

Another new Unfurl feature is parsing DoH (DNS over HTTPS) requests! I haven't run into these often in URLs, but hey, it's nice that Unfurl can parse them for you if you do! Example: https://dfir.blog/unfurl/?url=https://dnsserver.example… ★ 2

Unfurl can parse JSON Web Tokens! At the highest level, JWTs have three parts: header, payload, and signature. Unfurl first splits a #JWT into those three components, then base64-decodes the header and payload, then parses the resulting JS… ★ 7

🐘 Community & instance

Home server

infosec.exchange

A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.

✅ Link-verified

Verified link

Proved ownership of a website linked on their profile — Mastodon's green-check verification, a real identity signal rather than a paid badge.

On Mastodon since

Nov 2022

Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.

👁️Averages 4 views per post.

📤Posts about 0.1× per week.

🕵️ Fake follower check

Estimated

52/100

Fair Credibility score

76%

Mixed Real audience

Medium Fake-follower risk

High Data confidence

Est. 76% real, active audience · Medium fake-follower risk.
Low engagement (~1.0% of followers engage each post) — a sign of an inflated or inactive audience.
Verified account.
Established account (3+ years old).

Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

About

I do #DFIR and work on open source tools. Author of Unfurl and Hindsight.

📸 Gallery

🔀 Audience overlap

Estimated

Estimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.

Andy Luhrs 18%

cuddly-heroes 17%

MeredithW 17%

Nathan Hamiel :2001: 13%

ÐДѷє ۷ǿȵ ຣ 11%

syn@yourcomputer #:cursor: 10%

More like this

Find more →

Mastodon ＋

ÐДѷє ۷ǿȵ ຣ ✓

@dave_von_s@infosec.exchange

@cuddlyhero@abdl.link

385 Followers

Mastodon ＋

syn@yourcomputer #:cursor: ✓

@dave@basilisk.gallery

385 Followers

Mastodon ＋

MeredithW

@meredithw@wandering.shop

385 Followers

Mastodon ＋

Nathan Hamiel :2001: ✓

@nhamiel@infosec.exchange

385 Followers

Frequently asked questions

How much does RyanDFIR charge for a sponsorship?

RyanDFIR hasn't published fixed prices yet. Send a proposal through SocialDB and agree terms directly — your payment is held in escrow until the work is approved.

How do I contact RyanDFIR for a brand deal or collaboration?

Send a paid deal or collab request right here on SocialDB — we notify RyanDFIR, and once they accept, your payment is held safely in escrow and released when the work is approved. You don't need to track down an email.

How many followers does RyanDFIR have?

RyanDFIR has 385 followers on Mastodon.

Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove

RyanDFIR✓ Add us as a preferred source on Google

Make a deal with RyanDFIR

Known for

📊 Post engagement

📊 Activity & format

Recent posts

🐘 Community & instance

💡 Facts

🕵️ Fake follower check

About

📸 Gallery

🔀 Audience overlap

More like this

Frequently asked questions

✉ Message RyanDFIR

🎤 Event / appearance with RyanDFIR