Tobias Knecht

Founder & CEO @abusix, Co-Chair RIPE Anti-Abuse Working Group

[Tobias Knecht @knutix]

QR phishing up 146%. Content scanners can't read images. But the sending IPs and landing page domains still leave tracks. Network-layer reputation catches what content filters miss. #Quishing #ThreatIntel #Abusix

[Tobias Knecht @knutix]

Median patch time: 43 days (up from 32). Vuln exploitation: now the #1 breach vector.

For ISPs: every slow-patching customer is a future abuse origin. You need to see it before the complaints arrive. #DBIR2026 #CyberSecurity #Abusix

[Tobias Knecht @knutix]

5,500+ GitHub repos poisoned in one automated wave via hijacked Actions tokens.

Scale attacks leave infrastructure tracks. Real-time abuse data sees the wave before the reports land.

#SupplyChain #ThreatIntel

[Tobias Knecht @knutix]

The FBI warned about Kali365 PhaaS: bypasses MFA via OAuth token theft. Content filters didn't catch it.

The sending infrastructure still left tracks. It always does.

#PhishingAsAService #ThreatIntel

[Tobias Knecht @knutix]

cPanel CVSS 9.8 — 70M+ domains, actively exploited, CISA KEV listed.

Under NIS2, hosting providers are essential entities. "We were patching" doesn't stop compromised servers from becoming spam infrastructure.

Abuse intelligence closes that window. #NIS2 #CyberSecurity

[Tobias Knecht @knutix]

232% more malicious domains in 6 months. AI spins up phishing infra faster than any team can track it. Your blocklist is either alive — or it's already obsolete. #ThreatIntelligence #EmailSecurity #Abusix

[Tobias Knecht @knutix]

Glassworm botnet: infected devs via VSCode extensions, npm packages, GitHub repos. C2 infrastructure ran for months.

Attack chains change. The IPs and domains running them don't.

Real-time reputation data is still the fastest signal. #CyberSecurity #ThreatIntel

[Tobias Knecht @knutix]

AI phishing up 1,265% in a year. Click-through: 54% vs 12% for traditional lures.

Attackers scale content with AI. They also scale infrastructure with automation.

Complaint-driven detection can't keep up. Real-time IP behavioral signals can.

#Phishing #AI #Infosec

[Tobias Knecht @knutix]

Article 19: handle DNS abuse through legal process first. Minimal intervention.

Meanwhile malicious domains in safe-haven jurisdictions operate for months while courts deliberate.

Real-time DNS threat intel doesn't wait for judicial calendar time.

#DNS #AbuseOps #Infosec

[Tobias Knecht @knutix]

Amazon SES abused for phishing. SPF pass. DKIM pass. DMARC pass.

When attackers build their infrastructure to pass your filters by design, authentication is no longer the defense.

Behavioral signals are the layer that still works.

#EmailSecurity #Phishing #Infosec

[Tobias Knecht @knutix]

Google. Yahoo. Microsoft. All mandated DMARC.

Result: 9% of domains at p=reject. 91% still spoofable.

Authentication without enforcement doesn't protect anything. It just creates an audit trail.

#DMARC #EmailSecurity #Infosec

[Tobias Knecht @knutix]

Multiple critical CVEs in dnsmasq — cache poisoning, RCE, privilege escalation. Fixed in 2.92rel2.

The catch: dnsmasq is in millions of ISP-provisioned routers and embedded devices. You can't patch what you don't know you're running.

Know your stack.

#DNS #Infosec #NetworkSecu

[Tobias Knecht @knutix]

46% of global spam now comes from compromised accounts on Gmail, Outlook, and SaaS platforms.

SPF/DKIM/DMARC all pass. IP reputation: clean. Standard defenses: blind.

What catches it: real-time abuse signals from actual receiving infrastructure.

#EmailSecurity #ThreatIntel #IS

[Tobias Knecht @knutix]

369K devices. 163 countries. Years of operation as anonymous attack proxies. SocksEscort ran on ISP and hosting networks without detection. Real-time IP reputation finds infected devices before law enforcement does. #ISP #BotnetTakedown #Cybersecurity

[Tobias Knecht @knutix]

Microsoft: 35K phishing victims, 13K orgs, 26 countries — in 3 days.

Sent through legitimate services. SPF/DKIM/DMARC passed clean.

QR code phishing is the fastest-growing 2026 attack vector. Static reputation can't scan behind a QR image.

#Phishing #ThreatIntel #Infosec

[Tobias Knecht @knutix]

NIS2 is fully in force across the EU. Luxembourg was the last major holdout — enacted May 10.

For ISPs: the documentation phase is over. Regulators now want proof of operational abuse detection, not policies.

#NIS2 #ISP #Compliance

[Tobias Knecht @knutix]

ICANN just opened a new gTLD round — first since 2012. Historical data: 77% of new TLD domains are intentionally registered for abuse. New TLDs = new blocklist work. Real-time data covers them. Static feeds don't. #DNS #ThreatIntel #ISP

[Tobias Knecht @knutix]

67% of credential-stuffing attacks hide behind residential proxies. The IP looks clean. The behavior isn't. IP reputation is the starting point — behavioral signals are what actually catches it. #ISP #ThreatIntel #NetworkSecurity

[Tobias Knecht @knutix]

86% of phishing attacks are AI-generated now (KnowBe4 Q1 2026).

What AI changes: velocity. Infrastructure that didn't exist Monday is abusing your network by Wednesday.

The abuse complaint arrives after the damage. Real-time telemetry doesn't.

#CyberSecurity #ThreatIntel #ISP

[Tobias Knecht @knutix]

8.3 billion phishing threats in Q1 2026 alone. QR code attacks up 146%. CAPTCHA-gated up 125%.

At this automation scale, blocklists need to move faster than attackers pivot infrastructure — not faster than the next report.

#CyberSecurity #ThreatIntel #EmailSecurity