GAYINT

Bringing CTI out of the closet since 2025.

Customer Reviews:

"it’s… so beautiful 🥹🌈" -Will B

"GAYINT is my favourite TI platform on the Citadel" -MustardFacial

"I like my CTI like I like my partners. Authentic and a little kinky." -Seven

"the pewpews are better left to the professionals over at gayint " -BurritoSec

"<3" -Ian Campbell

"I now get my intel from an account called GAYINT" -Kevin Beaumont

#GAYINT :gayint:

Blog: https://blog.gayint.org/
PewPew Map: https://pewpew.gayint.org
LinkedIn: https://www.linkedin.com/in/gayint
Blog RSS: https://blog.gayint.org/rss.xml
IOC RSS: https://blog.gayint.org/ioc_rss.xml
Intel: https://intel.gayint.org

Public Key

npub1eznzdgefq0ece8yljlxtaadscv4skav3ckk38gv3qw04s25mrt2s5fnyq3

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsv3f3x5v5s8uuvnj0e0n977kcvx2ctwkguttgn5xgs886c92d344gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dscrtzyr

Publishing to

nostr.wine

nos.lol

relay.damus.io

Author Public Key

npub1eznzdgefq0ece8yljlxtaadscv4skav3ckk38gv3qw04s25mrt2s5fnyq3

Show more details

Published at

2025-12-25T18:47:32Z

Kind type

0 Metadata

Event JSON

{ "id": "a65707143bf8e857f29da3c04269dbd90052c066f0d7241a036b55f011c496bc", "pubkey": "c8a626a32903f38c9c9f97ccbef5b0c32b0b7591c5ad13a191039f582a9b1ad5", "created_at": 1766688452, "kind": 0, "tags": [ [ "emoji", "gayint", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/628/576/original/d8d3798d3762427f.png" ], [ "t", "gayint" ], [ "proxy", "https://infosec.exchange/users/gayint", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/gayint", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"GAYINT\",\"about\":\"Bringing CTI out of the closet since 2025.\\n\\nCustomer Reviews:\\n\\n\\\"it’s… so beautiful 🥹🌈\\\" -Will B\\n\\n\\\"GAYINT is my favourite TI platform on the Citadel\\\" -MustardFacial\\n\\n\\\"I like my CTI like I like my partners. Authentic and a little kinky.\\\" -Seven\\n\\n\\\"the pewpews are better left to the professionals over at gayint \\\" -BurritoSec\\n\\n\\\"\u003c3\\\" -Ian Campbell\\n\\n\\\"I now get my intel from an account called GAYINT\\\" -Kevin Beaumont\\n\\n#GAYINT :gayint:\\n\\nBlog: https://blog.gayint.org/\\nPewPew Map: https://pewpew.gayint.org\\nLinkedIn: https://www.linkedin.com/in/gayint\\nBlog RSS: https://blog.gayint.org/rss.xml\\nIOC RSS: https://blog.gayint.org/ioc_rss.xml\\nIntel: https://intel.gayint.org\\n\",\"website\":\"https://infosec.exchange/@gayint\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/115/108/064/401/743/125/original/3cc28c59f648611a.png\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/115/108/064/401/743/125/original/1225b0ee00e13d76.png\",\"nip05\":\"[email protected]\"}", "sig": "8e0dd653a8cdff5225a8edd8b581f6a83b43670234088324ee63af5fe0b281639d1def1a085f363b4d7b39b1f384d8a20e879cffb96754b8c8a08d2e1fb4290f" }

Last Notes

2026-07-29 03:30:39 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/001/144/880/142/230/original/061ea99115f715be.mp4

2026-06-17 20:42:18 UTC

Fortinet, HudsonRock and SocRadar can all responsibly disclose deez nutz #GAYINT

2026-06-17 19:41:10 UTC

Hey cuties. Long time, no blog. We hope you are having a powerful and rewarding Pride Month. To celebrate, we've got something fun for you.
Since Hudson Rock broke the news on the FortiBleed or whatever, and their site is pretty unusable, we might as well give you the info you're looking for. Well, not all of it. You'll have to beg for the rest. 🫦
https://blog.gayint.org/fortibleed.html
#FuckHudsonRock #FortiBleed #FortiShit #GAYINT #FURINT #Pride #ThreatIntel

2026-06-11 19:39:58 UTC

Since we've been asked about it several times lately, here's our starting point for an easy TLD block list. Obviously you would need to confirm that it doesn't include any you need but it's a decent place to start.
https://codeberg.org/gayint/lists/src/branch/main/easyBlockTlds.txt
#GAYINT

2026-06-09 18:39:04 UTC

Phishing testing indicators have been added to our first public repo. Please feel free to send more our way if you know of others.
https://codeberg.org/gayint/phishing_test_indicators/src/branch/main/headers
#GAYINT

2026-05-29 13:42:52 UTC

If any of you lovely creatures are at BSides Harrisburg, be on the lookout for the GAYINT sticker fairy. :8bitrainbow:

2026-05-27 18:27:40 UTC

Business idea: ATS that only approves queer gremlins. Call it GAYDAR.

2026-05-14 17:11:19 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/574/036/266/076/881/original/75fe3dbf64c9c1d2.png

2026-05-13 20:22:48 UTC

Happy Wednesday. Here, have a list of about 3500 domains that are part of a Chinese domain reseller network. :8bitrainbow:
https://blog.gayint.org/intel/resellerDomains20260513.txt
#GAYINT #threatIntel

2026-05-06 22:52:05 UTC

Okay **now** it's fabulous. :yassquatch:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/530/074/444/578/237/original/654935f34846e12e.jpg

2026-05-05 23:17:01 UTC

Abolish Cloudflare.

2026-05-05 01:56:09 UTC

He may not realize it but @npub1vtx…e7wk should probably be giving us kickbacks for providing an OOB After Dark chat to keep a bunch of horny and fabulous degenerates off his instance. :yassquatch:

2026-05-04 17:48:41 UTC

We found some nerds going to Blue Hat this week so we gave them some stickers to hand out. If you want one, you'll have to go around asking people what they think about MOIST GRASSHOPPER.
#GAYINT #blueHat

2026-05-04 14:13:39 UTC

Happy Monday you beautiful nerds. There are plenty of wordlists out there but none as fabulous as ours. Here is a list of creds attempted against some of our VPN portals that people really want access to. It's updated daily so check in regularly if that's your thing. :8bitrainbow:
https://blog.gayint.org/intel/vpnCreds.txt
#GAYINT

2026-05-01 18:11:15 UTC

#fuckCloudflare
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/500/659/900/650/306/original/005cadfc798be960.png

2026-04-28 18:25:28 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/483/725/274/151/629/original/bd4ad84f0d7b14df.png

2026-04-28 17:56:16 UTC

https://cyberchef.gayint.org/

2026-04-23 21:04:25 UTC

- reply

The investigation is ongoing. But yeah, probably. :BlobhajHoldSassage:

2026-04-23 21:01:33 UTC

- reply

Good news: Our Intel site is fully operational again. It may look the same as before and that's by design. Because it is the same. For now.
https://intel.gayint.org/

2026-04-21 13:25:56 UTC

We're doing some work this week on our automation so our block lists are not accessible at this time on the Intel site:
https://intel.gayint.org/
However, you can still generate your own prefix lists based on our ASN block list, the Spamhaus ASN DROP list, or your own by following the instructions here:
https://blog.gayint.org/asnsToPrefixes.html
And if you want direct access to the latest naughty ASN list, you can get to it here for now:
https://blog.gayint.org/intel/naughtyAsns.txt
#GAYINT

2026-04-18 00:11:50 UTC

💅
https://dti.domaintools.com/research/mois-linked-moist-grasshopper-homeland-justice-karmabelow80-handala-hackers-campaigns-and-evolution
#GAYINT #CTI #threatIntel
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/422/802/786/301/477/original/dcaf6f9f99f36658.jpg

2026-04-14 21:40:30 UTC

Just one more proclamation of groundbreaking public/private information sharing (read: "please give us free data") by some assistant deputy to the associate director of [insert agency name] at a broad-scope "security forum" conference attended only by people who will credulously tell you ICMP runs on port 80 and we just might solve cyber, y'all.

2026-04-14 14:16:24 UTC

Reminder that we have a list of TLDs that we have seen good results in blocking. Obviously you need to evaluate for your environment, but you can cut out a lot of malicious content and noise at the TLD level without having to worry about keeping up with all the apex domains.
https://blog.gayint.org/intel/easyBlockTlds.txt

2026-04-09 16:20:09 UTC

We just added 69 new ASNs ( nice ) to the naughty ASN list. That brings us to a total of 2301 ASNs in the naughty list. 573 of them are currently not advertising prefixes. That leaves 1728 ASNs with their 82,991 prefixes cached on our intel site: https://intel.gayint.org
#GAYINT

2026-04-07 19:04:18 UTC

Hey @npub1qm4…h363, welcome to the party.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/364/968/214/180/047/original/f54bc9dc481c4119.png

2026-04-07 01:16:51 UTC

Be gay do fashion. :8bitrainbow:
https://teamlocker.squadlocker.com/#/lockers/gayint-2968078
Disclosure: We set the store up for no profits. We make no money off of sales here. The only information we get from purchases is order number, date of purchase, name used, number of items ordered, and total cost of the order.
Also, at this time, shipments are only available to US and Canada addresses.
#GAYINT

2026-03-13 21:12:08 UTC

You use LLMs to make slop. We jailbreak shopping assistant AIs to look up the stock price of Grindr for us. We are not the same.

2025-12-12 03:18:02 UTC

- reply

Nut milk :nicosmug:

2025-12-07 17:28:11 UTC

We are finally able to announce that GIAYINT is the recipient of the first ever FIFA CTI Vendor Peace Prize. Thank you all for your support. It's nice to finally be recognized for being too far up and to the right for Gartner to include us. 🫶
#GAYINT

2025-11-26 22:30:42 UTC

Hey there kiddos!
It's your GAYINT Internet Auntie, here to have some real talk. There's a whole bunch of major holidays coming up (US Thanksgiving, then a whole slew of other days throughout December/January depending on your region/religion). And holidays are stressful.
That goes double when you're. Well. Kinda different. Maybe queer, maybe neurodivergent, both, something else... Look. Holidays are complicated at the best of times. And, these are, quite frankly, not the best of times.
Maybe you're with your family and you wish you were a thousand miles away. Maybe you're a thousand miles away and you wish you were with your family. Maybe you're glad to be with your family, but they can be a bit a bit much. And it's easy to feel like you're the problem.
Listen.
Really listen.
You. Are. Not. A. Problem.
You are perfect just the way you are.
You are doing the best you can in a system that is working against you every step of the way. And you're still here.
Quite frankly, that is *amazing*. *You* are *amazing*, sweetie!
Whether its your family, or your friends, or your pocket friends, or just your Internet Auntie, know that there's people who love you and cherish you and want nothing but the best for you.
I'm not gonna lie to you and say everything's gonna be fine, but I can absolutely tell you with certainty that you're not alone, okay?
And remember: you're doing *amazing*!
#GAYINT

2025-11-24 18:44:31 UTC

Look, we're not mad. We're just disappointed that some of y'all weren't listening last time and let this happen again. :8bitrainbow:
https://blog.gayint.org/shaiHulud2.html
#GAYINT #FURINT

2025-11-08 03:41:47 UTC

After reviewing our nginx logs we realized OpenAI has been scraping our threat actor naming scheme and ignoring our robots.txt. While this is frustrating from a compliance issue it also means we have successfully poisoned ChatGPT and many other LLMs. It now knows that FIESTY CORNHOLE is aka Lace Tempest and SPICY O-RING is @npub1udn…3tjr
#GAYINT
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/512/001/264/055/963/original/a37421b30d76d824.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/512/001/276/446/922/original/28c30a69ce161ac6.png

2025-10-27 17:43:43 UTC

Hey friends, shit's fucked. Lots of people are struggling. And a lot of people who can help don't know where to start. So to kick off some extra giving, here's an offer: DM us a receipt of a donation you made for $50USD or more to a food bank and we'll mail you a GAYINT sticker. While supplies last. We only have like 50 stickers left from the first batch but more is on order already. Is that a lot for a sticker? Yes. It's just a fucking sticker. But helping direct people to a way to help their community is priceless.
Feeling super generous? Or maybe you just want to show off? DM a receipt showing a donation of $1000USD or more to a food bank and we'll work on getting you a threat actor name of your own in the upcoming GAYINT Threat Actor Taxonomy v2.
Can't donate? That's cool. Boost this toot and help where you can. Also, food banks, as well as the entire food distribution chain in the US, always need more volunteer labor.
Don't know of a good food bank local to you? Check here: https://www.feedingamerica.org/find-your-local-foodbank/all-food-banks
Currently we can only guarantee delivery of stickers to people with US addresses. International delivery isn't something we are currently prepared to do. Sorry. But at least you likely live in a country where this shit isn't necessary.
#GAYINT #FURINT #benevolentNerds
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/447/350/696/159/007/original/ada9fd2bce49e2d4.png

2025-10-08 21:30:55 UTC

- reply

That is not a silly question at all. And it's exactly why we published this:
https://blog.gayint.org/asnsToPrefixes.html

2025-10-08 18:55:50 UTC

Reminder that we maintain a list of bad ASNs that we suggest blocking inbound to your remote access and admin portals where possible:
https://blog.gayint.org/badasns.html
#GAYINT

2025-10-06 15:58:14 UTC

Is it really still Cybersecurity Awareness Month? Okay, here's another tip: Patch your shit. Constantly. Don't wait for your systems to force you into it. Make a habit of routinely checking for updates.
#cyberSecurityAwarenessMonth #justTheTip #GAYINT

2025-09-25 17:49:21 UTC

Fedi creatures can have another RSS feed, as a treat.
https://blog.gayint.org/iocRss.html
#GAYINT