The DFIR Report ✓

@TheDFIRReport · thedfirreport.com/contact · joined 03 Apr 2020

Real Intrusions by Real Attackers, the Truth Behind the Intrusion

69 826Followers

0Following

1 828Posts total

38KViews on collected posts

Latest posts

The DFIR Report ✓@TheDFIRReport18 Sep

🔒 Private DFIR Report: ViewState of Mind, Gladinet Exploit Opens the Door A binary, wacs.exe, was written to C:\CentreStack\ and executed, the Stowaway proxy tool, connecting to a remote server at 167.99.74[.]134:443 to establish deeper access and run initial discovery. 2.4K views · 16 likes · 5 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport17 Sep

"The threat actors have been using the associated Monero wallet for 738+ days and have netted around $5,159." Read the full report: https://t.co/r3MLgZip1Z #DFIR #ThreatIntel https://t.co/ibOsKFOMW1

2.5K views · 9 likes · 3 reposts · 2 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🛡️ Let the attackers tell you what they're after. Active Defense Threat Insights deploys strategic decoys that attract adversaries and capture their moves 24/7, turning real interactions into high-fidelity IOCs and mapped TTPs specific to your organization. Understand 2.5K views · 17 likes · 4 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🔎 Indicators from a case we are actively investigating: C2: 178[.]16[.]54[.]112:56001 Payload URL: hxxps://panaderiacoronado[.]com/temp/Frqzbx[.]exe node.exe running from AppData with an unusual flag: "C:\Users\<user>\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" 4.4K views · 69 likes · 21 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Feb

New logo. New website. Same DFIR Report team. 🔎 Check out the incredible analysts behind the research: https://t.co/Gep8oGeKik 26.1K views · 231 likes · 23 reposts · 5 replies Open on X →

Against accounts of the same size

4 posts from the last 90 days, next to the 10K–100K follower range. ordinary reach for its size, weaker reaction than most.

Median views2 496this account936median for 10K–100K

Reach, %3.57%this account3.43%median for 10K–100K

Engagement, %0.86%this account1.55%median for 10K–100K

Metric	This account	Median for 10K–100K	Ratio
Median views per post	2 496	936	2.67×
Reach (views ÷ followers)	3.57%	3.43%	1.04×
Engagement rate	0.86%	1.55%	0.55×

Others in this range → Compare with another account → How these benchmarks are built →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

26.1K16 Feb

4.4K16 Sep

2.5K

2.5K17 Sep

2.4K18 Sep

Last 5 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

1.00%16 Feb

2.02%16 Sep

0.86%

0.55%17 Sep

0.86%18 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.55%.

What the audience does

Likes64.7%342 in total

Reposts10.6%56 in total

Replies1.3%7 in total

Quotes0.2%1 in total

Bookmarks23.3%123 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.