Decoding threats.
Engineering defenses.

I work independently on security research, threat investigation, and systems development. Most of the work sits around malware behavior, DNS telemetry, secure infrastructure, and the practical problems that fall between those areas.

My client work is contract-based and technical. For ADAMnetworks, I analyze threat telemetry and malware behavior. For domainintelligence.uk, I work on DNS reputation mapping and telemetry tracking. With Nerds On Site, I help secure, architect, and manage commercial IT environments.

My personal projects sit outside client work, but they show the same pattern. Derp.ca is a malware infrastructure tracker and research notebook. It tracks C2 hosts, distribution hosts, ransomware claims, indicators, and writeups from sandbox output and community threat intelligence. The YARA rules are based on that research.

RogueBinary.com is the public reference for Rogue Binary MCP. The Ghidra, Radare2, and ILSpy servers are built for agent-driven reverse engineering: bounded output, cached backends, persistent analysis sessions, and focused binary triage.