Xavier Bellekens

Founder of Lupovis

[Xavier Bellekens @noktec]

There is an issue with poor ROI especially during a POC (here is an appliance, let’s hope it triggers), Honeypots have a bad reputation, Deception a bad connotation. Everyone can run cowrie or netcat and believe they created a deceptionsystem.

We’ve been focusing or sensors on CTI and preemptive security to change that perseption.

[Xavier Bellekens @noktec]

@rosslazer @anton_chuvakin @lennyzeltser The noise is close to 0. In fact it’s definitely your strongest and most reliable signal.

[Xavier Bellekens @noktec]

@lennyzeltser @anton_chuvakin Mostly ROI, that being said marketing played a huge role into it too!

[Xavier Bellekens @noktec]

@UK_Daniel_Card @DecryptedTech @Apple We called! There should be a business rep at your local apple store! They unlocked the situation & “fast tracked” - it only took 25 days 😂

[Xavier Bellekens @noktec]

@FAShooter @PhileasGatsby @LaxTechnology Tous les 5 ans je vois un tweet qui les mentionnent et à chaque fois je me dis que j’aurais du en acheter un 😂

[Xavier Bellekens @noktec]

@ParthJadhav8 @mohantyabhijit @bevel @bevel_health Fun thin with @bevel_health is that you can ask their AI to talk about your health but first you want to know about honeypots 🍯😂

[Xavier Bellekens @noktec]

@X20723360 @mohsinxyz_ @ParthJadhav8 Not really bevel does the same … and for 99 usd

[Xavier Bellekens @noktec]

I haven't been in academia for almost 5 years, but it's nice to see that my research hit a 1000 citations last year alone.

For anyone out of academia, there are a couple of nice milestones I looked for and many others do too, the first citation, the first 100, the first 1000 etc.

Most academics never reach 10k and 1k in a year is not bad at all.

For those less familiar with it, a citation simply means another researcher has used and referenced your work in their own. It’s one of the signals that indicate that what you built is still being read, used, and shaping ongoing research somehow.

btw citation is not impact ;-)

[Xavier Bellekens @noktec]

Here are some more 🔥

[Xavier Bellekens @noktec]

I went down a rabbit hole looking at kids @YouTube this evening with my nephews.

I kept seeing the same videos over and over again… but on completely different channels.

Same animations
Same voiceovers
Same titles
Same shorts

Sometimes just in a different order.

And these aren’t small channels either.
A lot of them have:

1M+ subscribers
some closer to 10M
millions of views on Shorts

Here are a few I came across:

Mini Yum Chef
Quizzlepop-LearnPlay
ThinkDoos
Growziki
BillyBlipBoss
KittyToonZoo
SmartJoLetsLearn
KIDZOKI_official
FundzyBits
LittleFlipZoo
PlayToon_Learn_Play
dadadoo-learn-play
VocaToonFun
SmileToonKids
EmilysPlayhouse-LearningVideos
Fixy-Mixy
ChupiChapa_
FriendToon- Learn & Play
Leo’s Playtime
BiBiLo
Play Today
PurrToonFun
ChakaKidsPlay

And honestly the list keeps going.

If you search a bit, you start recognising the same clips everywhere.

What it looks like (from the outside at least):

One set of videos being reused across a lot of different channels.

Each one tweaks things slightly:

Different channel name
Same titles
clips reordered
not even minor edits

Then they just post a lot and see what sticks.
And it works.

Especially with kids content where repetition is normal and people don’t really question whether they’ve seen something before.

I was wondering how this fits with the rules on @YouTubeCreators around reused or mass-produced content.

Given this is a "network"

From what I can tell, the network re-shares many videos, and I am assuming monetisation?

So you end up with a lot of these channels networks doing well.

They even have an identity
Recognisable characters, I keep seeing the same "actors"
volume and very very low variation.

If you’re building in this space, it raises a pretty simple question:

Do you try to compete on volume like this, or actually build something people recognise and come back to?
Curious if others have noticed the same thing.

oh and here is a small graph of channels sharing a common content pool

[Xavier Bellekens @noktec]

@Issa201735 @bearstech Imagine maintenant si ils le mettaient a dispo de l europe et pas just des Pays-Bas!

[Xavier Bellekens @noktec]

Great to see @GreyNoiseIO pushing this forward. We’ve been building in this space for 5+ years and it’s exciting to see the industry catching up.
The perspective you get from the attacker interaction is fundamentally different.

[GreyNoise @GreyNoiseIO]

Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝

[Xavier Bellekens @noktec]

@catc0n @HackingLZ @Junior_Baines The « That we call canaries » part in the article got me 🫠

[Xavier Bellekens @noktec]

@guyrleech @austeregrim @CiscoSecure @Hilton @OneRSAC @Cisco 99% will be discarded

[Xavier Bellekens @noktec]

So @CiscoSecure went around all the rooms of the @Hilton at @OneRSAC at night to place one time use - small lcd video of their CEO delivering a message … loads of waste - let’s look what’s inside

[Xavier Bellekens @noktec]

No auth → full backup → decryption key handed to you.

On this one, if it is exposed, you’re not being scanned.

You’re being robbed.

[Lupovis @LupovisDefence]

We’re seeing CVE-2026-27944 hit our telemetry.

Currently without a KEV inclusion.
Unauthenticated access to /api/backup in Nginx UI versions lets an attacker download a full system bkp, and the response discloses the material needed to decrypt it via X-Backup-Security.
Patch now

[Xavier Bellekens @noktec]

@guyrleech @CiscoSecure @Hilton @OneRSAC @Cisco I did not see any! I was appalled at the waste!

[Xavier Bellekens @noktec]

@JohnyBallsack27 @CiscoSecure @Hilton @OneRSAC but does your straw has an LCD screen and a battery! I don't think so!

[Xavier Bellekens @noktec]

@furiouswhopper @CiscoSecure @Hilton @OneRSAC too late now 😅 🤦‍♂️