@tmctmt
tmctmt.com/posts/
Joined April 2026
  • Tweets52
  • Following74
  • Followers844
20Media
Pinned Tweet
tmctmt@tmctmtMay 15
Mullvad exit IPs are surprisingly identifying tmctmt.com/posts/mullvad-exi…

Mullvad exit IPs as a fingerprinting vector

Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the...

tmctmt.com
50
220
46
2,433
828,233
I found a (somewhat underwhelming) prototype pollution bug in Tampermonkey tmctmt.com/posts/tampermonke…

A (somewhat underwhelming) prototype pollution in Tampermonkey

If you’ve used a userscript manager before you’re probably familiar with the comment metatags that denote a script’s name, author, the websites it runs on, etc. // ==UserScript== // @name Undiscord...

tmctmt.com
4
389
You can get an approximate edge-to-origin timing on most Cloudflare sites by subtracting the latency of /cdn-cgi/trace (hits edge only) from your normal requests' latency. If you have a bunch of proxies you can cycle between edges and get a good idea of the origin's geoloc
4
5
199
4,992
Demo: gist.github.com/tmctmt/3f1d2… It uses Mullvad proxies to cycle edges so you need to be connected to their VPN to use this.

Cloudflare origin geolocator

Cloudflare origin geolocator. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
17
514
Fascinated by the Better Call Saul email bombing script
3
60
If you have Signal installed on a device you don't check often, it basically defeats the purpose of disappearing messages.
1
7
602
not sure if this applies to deleted messages or view-once media too
2
135
I was wondering why Chrome was refusing to use ECH on websites where it works just fine in Firefox. It turns out Chrome only enables ECH if your system DNS server supports DoH. If you use Mullvad, its internal DNS servers are plaintext only.
3
3
1
71
11,190
To clarify, the issue isn't a lack of encryption for DNS queries. The traffic is already encrypted at the tunnel layer and it stays in Mullvad's intranet. The real issue is that Chrome *thinks* it's insecure, which triggers it to turn off a privacy feature.
14
958
people in the replies have never stalked someone online and it shows😔
alpha@omarsbigsisterMay 30
Stop telling me to use duckduckgo IT SUCKS
1
3
1,352
I can confirm that Mullvad's new mitigation (currently available on select servers) indeed fixes the IP position correlation flaw.
Mullvad.net
@mullvadnetMay 20
On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users. We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks. Read more here: mullvad.net/blog/exit-ip-fin…

Exit IP fingerprinting between VPN servers | Mullvad VPN

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.

mullvad.net
3
44
556
57,956
The IPs are still assigned deterministically though and afaict they won't change until the pubkey rotates, which is a bit of a bummer.
12
1,955
Just released a tool for identifying domains under common ownership using Cloudflare nameserver pair correlation (with some historical data support!): tmctmt.github.io/cloudflare-…
2
3
4
1,069
For those unfamiliar with the technique, this post by Aidan Thomson describes it pretty well: interrupt.sh/blog/discoverin…

Discovering domains via NS correlation

A simple OSINT technique for discovering related domains.

interrupt.sh
2
2
528
I don't plan on keeping the database up to date, but since Cloudflare is already experimenting with randomly assigned nameservers, there may not be much point in doing so for much longer anyway.
353
A novel-ish means of finding Satoshi, including a website where you can test your own guesses. All bad writing is by me. Done in collaboration with @tmctmt. foxchapelresearch.substack.c… If you're interested in funding this, please lmk.
9
9
4
70
9,139
how it feels to say pwned as a gen z
Herman.fun
@doomscroll_xMay 9
The Millennial falloff will be studied for generations
8
705
neat trick with mediafire: you can reveal uploader names for single files using mediafire[.]com/api/1.5/file/get_info.php?quick_key=file_id_goes_here
8
70
2
1,156
56,966
tmctmt retweeted
Rafael
@beescoituMar 21
Totally forgot to post about this, but after researching, I had suspicion that some of the netflow data from tzulo.com (AS11878) was being fed into Team Cymru's platform. A bunch of VPN providers, including Mullvad (22% of their servers!), ivpn and Windscribe were Tzulo clients at the time. After trying direct contact with Tzulo and getting a not-so-helpful response, I decided to reach out to the VPNs. Out of all of them, surprisingly @windscribe was the only one that took a closer look at it. They escalated it to Tzulo, who confirmed the culprit was Sharktech, their upstream provider (also mentioned in my initial research). Tzulo has since migrated away from them, but this confirms netflow data from some of these servers was indeed being captured before September 2025 (when Windscribe sent me this email). Hopefully this has contributed a bit to the privacy community. Kudos to @windscribe for caring and to @404mediaco for inspiring this research :)
Rafael
@beescoitu18 May 2025
Spent pretty much the whole day compiling information on how and from where Team Cymru captures netflow data. I've published an initial version of all the resources I could find here (Includes a WIP version of ISPs that share data with them!): github.com/beescuit/netflow-…

GitHub - beescuit/netflow-data: Collection of publicly available resources related to the collect...

Collection of publicly available resources related to the collection, sale, and implications of netflow data. - beescuit/netflow-data

github.com
2
7
2
55
15,405
The worst part about the YellowKey exploit is the sheer number of misinformed people who are unknowingly going to bottleneck their SSD speeds by like 80% after switching to VeraCrypt instead of simply using password-based BitLocker github.com/veracrypt/VeraCry… reddit.com/r/VeraCrypt/comme…
Lain on the Blockchain
@CryptoCyberiaMay 17
After this Bitlocker backd- I mean exploit, Veracrypt schizos should be incredibly smug. A lot has been said on FOSS vs. closed source with regards to security, but for something as solved as OS encryption, FOSS makes most sense, by a lot.
5
1
1
59
10,411
Load more