Group-IB

https://www.group-ib.com/blog/

Singapore-headquartered global CTI firm. WebFetch returns HTTP 403 (re-confirmed 2026-05-08); RSS at /blog/feed/ also 403. Bridge fetcher would need www.group-ib.com on its allowlist; not currently allowed because the publisher's WAF was observed to drop the bridge UA too in earlier tests. Surface as coverage gap. Retest periodically; recover to `active` if a CSAF/RSS becomes available. | 2026-06-20 full audit (v2. Remains a coverage gap; WebSearch-only discovery. Do NOT WebFetch or bridge; it will 503. Recover if a CSAF/RSS becomes available. | 2026-07-05 admiralty audit: B, global CTI vendor, original research. RECOVER demoted -> active: the WAF no longer drops the bridge UA (listing + article body both fetch 200; newest post 1 Jul 2026). Operator: change fetch_method blocked -> bridge. | 2026-07-06 jina-fallback recovery: DONE, fetch_method blocked -> bridge. RECIPE: `python3 tools/fetch_source.py url https://www.group-ib.com/blog/` returns 200 (~800 KB real blog, current posts); the `url` command auto-falls-back to the r.jina.ai reader (`jina <URL>`, ~128 KB) if the Cloudflare Managed-Challenge ever returns, so there are two working transports. Removed from source_health TRANSPORT_BLOCKED_UNREACHABLE; probes bridge-ok. RSS at /blog/feed/ still 403, use the `url`/`jina` HTML path, drill per-article /blog/<slug>/. | 2026-08-03 weekly: direct WebFetch still returns HTTP 503, but `python3 tools/fetch_source.py url https://www.group-ib.com/blog/<slug>/` returns the full article body and the blog RSS at /blog/rss.xml lists in-window posts. Recipe confirmed working; contributed a research finding this run. | 2026-08-13: contributed the WindRelay/SpyNote NFC-relay research this run; blog RSS at https://www.group-ib.com/blog/rss.xml parsed cleanly and the article body was reachable via `fetch_source.py url`.