Independent cyber threat intelligence research by Deividas Lis, Lithuania.
I investigate the infrastructure, behaviour and people behind phishing, fraud, malware and information operations. I publish the evidence and its limits alongside every finding, in English and Lithuanian.
Read the research → · Radar · Signal Briefs · Public data · Lietuviškai
| What it is | Open | |
|---|---|---|
| HECAVEX Research | Bilingual investigations, technical detection guides and Signal Briefs. | hecavex.com · source |
| HECAVEX Radar | Potential phishing and impersonation domains relevant to Lithuania, collected from Certificate Transparency. Defanged and published as candidates for review, not verdicts. | radar.hecavex.com · source |
| Open Domain Radar | Run your own radar: a self-hosted Python app for collecting, reviewing and publishing domain-impersonation candidates for the brands you protect. Alpha. | source |
| Research Artifacts | Versioned evidence bundles behind published investigations, so findings can be checked and reproduced. | source |
- Radar snapshot: JSON or STIX 2.1 observations. Read the dataset guide before you integrate it.
- Publication metadata: every article with versions, translations and citation files.
- Everything else: the public data catalogue.
Radar entries are observations to investigate. Don't feed them straight into a blocklist.
- An observation is not a finding, and infrastructure overlap is not attribution.
- Confidence, provenance, dates and limitations sit beside the claim they qualify. See the methodology.
- Indicators are defanged. Sensitive evidence stays out of public repositories.
- Tools stay inspectable, self-hostable and usable without an account where possible.
For research collaboration, corrections or media requests, use the contact page or LinkedIn.