LIVE
⭐9.1M influencer listings 🏢100.3K sponsor listings 🌍123.1B combined audience reach 📊13 platforms indexed 🗺️130+ countries covered 🏷️10,000+ niches 🦋4.2M Bluesky creators 🎙️1.4M podcast creators 🟣1.3M Twitch creators 📈745K Pinterest creators 🥊324.7K Kick creators 279.6K YouTube creators 𝕏259.2K X creators 🐘253.8K Mastodon creators 🎵139.3K TikTok creators ✈️108.8K Telegram creators 🎮14.1K Discord creators 📈11.9K Substack creators 🎬4.6K Rumble creators 🧵3.7K Threads creators ⭐9.1M influencer listings 🏢100.3K sponsor listings 🌍123.1B combined audience reach 📊13 platforms indexed 🗺️130+ countries covered 🏷️10,000+ niches 🦋4.2M Bluesky creators 🎙️1.4M podcast creators 🟣1.3M Twitch creators 📈745K Pinterest creators 🥊324.7K Kick creators 279.6K YouTube creators 𝕏259.2K X creators 🐘253.8K Mastodon creators 🎵139.3K TikTok creators ✈️108.8K Telegram creators 🎮14.1K Discord creators 📈11.9K Substack creators 🎬4.6K Rumble creators 🧵3.7K Threads creators
The DFIR Report

The DFIR Report Add us as a preferred source on Google

Mastodon @thedfirreport@infosec.exchange
⚔ Compare ☆ Follow Own this channel?
🔄 Data last refreshed 27 days ago
Followers
1.3K
Account age
3 yrs
🎁 Free analysisfor The DFIR Report
🕵️Fake Followers CheckReal-audience % & bot risk→ 📊Engagement rateBenchmarked vs. peers→ 💰What they chargeFair sponsored-post price→

Known for

🚨 Investigation & Collaboration Request We are currently investigating malicious activity associated with the following LNK file: `1b3089a761da4a9b7a1bfb485cc857969346ce61` — `Employment_Verification_Details.lnk` We observed command-and-control communications with: 🌐 `work[.]officialm[.]com` — VT Score: 0/91 🌐 `31[.]192[.]107[.]162:443` — VT Score: 0/91 If you have observed related activity and/or3 views 🚨 Investigation & Collaboration Request We are currently investigating malicious activity associated with the following LNK file: `1b3089a761da4a9b7a1bfb485cc857969346ce61` — `Employment_Verification_Details.lnk` We observed command-and-control communications with: 🌐 `work[.]officialm[.]com` — VT Score: 0/91 🌐 `31[.]192[.]107[.]162:443` — VT Score: 0/91 If you have observed related activity and/or Use DFIR Report’s Threat Feed to gain early, actionable insight into attacker infrastructure before it becomes mainstream. Check it out here 👉 https://thedfirreport.com/products/threat-feed/1 views Use DFIR Report’s Threat Feed to gain early, actionable insight into attacker infrastructure before it becomes mainstream. Check it out here 👉 https://thedfirreport.com/products/threat-feed/ RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report 👇 https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/1 views RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report 👇 https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/ 🔒 Private DFIR Reports — From the Front Lines of Incident Response Go beyond high-level threat summaries. Our Private DFIR Reports deliver unredacted, evidence-based intrusion analysis drawn directly from real investigations. Each report provides a ground-truth view of how modern intrusions unfold with detailed timelines, command lines, file paths, and forensic artifacts. 📩 Contact us for details1 views 🔒 Private DFIR Reports — From the Front Lines of Incident Response Go beyond high-level threat summaries. Our Private DFIR Reports deliver unredacted, evidence-based intrusion analysis drawn directly from real investigations. Each report provides a ground-truth view of how modern intrusions unfold with detailed timelines, command lines, file paths, and forensic artifacts. 📩 Contact us for details

📊 Post engagement

Recent posts · likes + reposts
Jun 29latest
2
Avg engagement / post
1–2
Typical post (engagement)
0.1%
Engagement vs followers
72/100
Consistent reach
Nov 2022
On Mastodon since
Half of recent posts land between 1 and 2 likes + reposts (median 1) — a dependable floor a sponsored post can count on.

🔥 Top post: From smaller data sets to complex cases, DFIR Labs has case stud · 4 likes + reposts

📊 Activity & format

Posting cadence
2.3 / week
Posts several times a week.
Content mix
Mostly images
Recent: 2 text · 10 image · 0 video.

Recent posts

View on Mastodon ↗
🔥 Top post From smaller data sets to complex cases, DFIR Labs has case studies you can work through at your own pace — from your first investigation all the way to expert level. Start digging in 👉 https://thedfirreport.com/products/dfir-labs/ ★ 4
Use DFIR Report’s Threat Feed to gain early, actionable insight into attacker infrastructure before it becomes mainstream. Check it out here 👉 https://thedfirreport.com/products/threat-feed/ ★ 1 Did you know you can get notified when we publish a new report? Subscribe to our mailing list and receive updates directly in your inbox: https://thedfirreport.com/subscribe/ RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report 👇 https://thedfi… ★ 1 🔒 Private DFIR Reports — From the Front Lines of Incident Response Go beyond high-level threat summaries. Our Private DFIR Reports deliver unredacted, evidence-based intrusion analysis drawn directly from real investigations. Each report p… ★ 1 On the Exchange email server, the threat actor used a legitimate Windows executable, SystemSettingsAdminFlows.exe, which allows users to customize or configure the system settings to user’s preference. This LOLBIN was used to disable Windo… ★ 1 🚨 Investigation & Collaboration Request We are currently investigating malicious activity associated with the following LNK file: `1b3089a761da4a9b7a1bfb485cc857969346ce61` — `Employment_Verification_Details.lnk` We observed command-and-co… ★ 3 Step into real investigations. Real data, real cases, real threat actors, real tradecraft. Join us at DFIR Labs to put your skills to the test and gain insight from the real intrusions. 🧪 Your lab is waiting: https://thedfirreport.com/prod… ★ 1 Low noise. High signal. That’s not marketing language — it’s how we built our Threat Feed. If you get an alert in your environment from our feed — ping us. We’ll help triage it. That’s how much we trust the signal. We built this for defend… "From network traffic recorded during the second round of exploitation, we saw the ActiveMQ Server process downloading the malicious XML file containing the commands to be run in the command-line interface: " Report: https://thedfirreport.… ➡️ New report out today by Jake, Dino, Ahmed Farouk, @MittenSec, @angelo_violetti, and @r3nzsec. From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira 🔎 A user searching for ManageEngine OpManager was led to a fake downlo… ★ 2 🎉 New report out Monday 6/29 by Jake, Dino, Ahmed Farouk, @MittenSec, @angelo_violetti, and @r3nzsec. "Approximately 44 hours after the initial compromise, the threat actor initiated the Akira ransomware deployment, beginning with the bac…

🐘 Community & instance

Home server
infosec.exchange
A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.
On Mastodon since
Nov 2022
Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.
👁️Averages 2 views per post.
📤Posts about 2.3× per week.

🕵️ Fake follower check

Estimated
44/100
Fair Credibility score
73%
Mixed Real audience
Medium Fake-follower risk
Medium Data confidence
  • Est. 73% real, active audience · Medium fake-follower risk.
  • Low engagement (~0.1% of followers engage each post) — a sign of an inflated or inactive audience.
  • Established account (3+ years old).

Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

About

Real Intrusions by Real Attackers, the Truth Behind the Intrusion. Detections: http://github.com/The-DFIR-Report | Services: http://thedfirreport.com/services |

📸 Gallery

Use DFIR Report’s Threat Feed to gain early, actionable insight into attacker infrastructure before it becomes mainstream. Check it out here 👉 https://thedfirreport.com/products/threat-feed/ Did you know you can get notified when we publish a new report? Subscribe to our mailing list and receive updates directly in your inbox: https://thedfirreport.com/subscribe/ RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report 👇 https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/ 🔒 Private DFIR Reports — From the Front Lines of Incident Response Go beyond high-level threat summaries. Our Private DFIR Reports deliver unredacted, evidence-based intrusion analysis drawn directly from real investigations. Each report provides a ground-truth view of how modern intrusions unfold with detailed timelines, command lines, file paths, and forensic artifacts. 📩 Contact us for details On the Exchange email server, the threat actor used a legitimate Windows executable, SystemSettingsAdminFlows.exe, which allows users to customize or configure the system settings to user’s preference. This LOLBIN was used to disable Windows Defender settings on the server. Report: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ 🚨 Investigation & Collaboration Request We are currently investigating malicious activity associated with the following LNK file: `1b3089a761da4a9b7a1bfb485cc857969346ce61` — `Employment_Verification_Details.lnk` We observed command-and-control communications with: 🌐 `work[.]officialm[.]com` — VT Score: 0/91 🌐 `31[.]192[.]107[.]162:443` — VT Score: 0/91 If you have observed related activity and/or Step into real investigations. Real data, real cases, real threat actors, real tradecraft. Join us at DFIR Labs to put your skills to the test and gain insight from the real intrusions. 🧪 Your lab is waiting: https://thedfirreport.com/products/dfir-labs/ Low noise. High signal. That’s not marketing language — it’s how we built our Threat Feed. If you get an alert in your environment from our feed — ping us. We’ll help triage it. That’s how much we trust the signal. We built this for defenders who are tired of chasing ghosts and burning cycles on low-fidelity alerts. When it fires, it’s worth your time. 🔎 Real context 🎯 High-confidence detections ⚡

🔀 Audience overlap

Estimated

Estimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.

Richard Zach Richard Zach 17% Western Watersheds Project Western Watersheds Project 16% isotope239 🥸💻🇺🇦😣 isotope239 🥸💻🇺🇦😣 14% jonny jonny 14% Sharon Gibson Morgan Sharon Gibson Morgan 13% The Graffiti Express The Graffiti Express 11%

More like this

Find more →
Mastodon ＋
Western Watersheds Project
Western Watersheds Project
@westernwatershedsproject@mastodon.world
1.3K Followers
Mastodon ＋
isotope239 🥸💻🇺🇦😣
isotope239 🥸💻🇺🇦😣 ✓
@isotope239@mastodon.online
1.3K Followers
Mastodon ＋
The Graffiti Express
The Graffiti Express
@thegraffitiexpress@mstdn.social
1.3K Followers
Mastodon ＋
Sharon Gibson Morgan
Sharon Gibson Morgan
@sharongibson3@newsie.social
1.3K Followers
Mastodon ＋
jonny
jonny ✓
@jonny@social.coop
1.3K Followers
Mastodon ＋
Richard Zach
Richard Zach ✓
@rrrichardzach@mathstodon.xyz
1.3K Followers

Frequently asked questions

How much does The DFIR Report charge for a sponsorship?
The DFIR Report hasn't published fixed prices yet. Send a proposal through SocialDB and agree terms directly — your payment is held in escrow until the work is approved.
How do I contact The DFIR Report for a brand deal or collaboration?
Send a paid deal or collab request right here on SocialDB — we notify The DFIR Report, and once they accept, your payment is held safely in escrow and released when the work is approved. You don't need to track down an email.
How many followers does The DFIR Report have?
The DFIR Report has 1,346 followers on Mastodon.

✉ Message The DFIR Report

Reaching out to influencers is a Pro feature. Upgrade to message any influencer directly — perfect for brands and agencies booking sponsorships.

  • ✓ Message any influencer from their listing
  • ✓ The influencer gets notified by email
  • ✓ Manage every conversation in one inbox
See Pro $9.95/mo →

Already Pro? Log in.

🎤 Event / appearance with The DFIR Report

Booking an event / appearance is a Pro feature. Upgrade to book The DFIR Report for an in-person or virtual appearance — payment held safely in escrow until the event is done.

  • ✓ Book them for events, livestreams, panels & more
  • ✓ The DFIR Report gets notified by email
  • ✓ Fee held in escrow, released after the appearance
See Pro $9.95/mo →

Already Pro? Log in.

Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove

✉️ Contact