Independent Security Research with Real-World Impact
SH Consulting conducts independent security research to find overlooked weaknesses in internet infrastructure and report them to the organizations affected.
University infrastructure
Attackers hijacked abandoned subdomains at major US universities and used them to serve spam and adult content that Google indexed under trusted .edu names.
34 universities affected, including MIT, Harvard and Stanford.
Exposed Email Reports at New Zealand’s National Stadium
12 months
of unanswered disclosure. Fixed within a day of going public.
Covered by:
Abandoned DMARC Domain Exposed Security Reports
86
domains, including a Fortune 1000 manufacturer, a state university and two county governments. Disclosed to CISA.
Lapsed Domain Kept Receiving a Manufacturer’s Email
800+
misdirected emails, including live employee mail and daily security reports.
Covered by:
Dormant Domains Used for Brand Impersonation
79
dormant domains used to impersonate a top US real estate team.
Covered by:
Responsible Disclosure
1
Find
We look for abandoned, expired and misconfigured records in public DNS and email infrastructure.
2
Report privately
The affected organization hears from us first. Where the risk reaches further, we also notify CISA or the national CERT.
3
Publish after the fix
We publish once the issue is fixed, or after the organization has had a fair chance to respond.
Media Coverage
Show more
↓
Want the same checks run on your domains?
We’ll check your domains for the same issues: abandoned subdomains, expired DMARC records and lapsed domains.