Hunt.io

https://hunt.io/blog

Added 2026-07-30 as this run's single new candidate, surfaced by S3. Threat-infrastructure research blog; publishes original exposed-C2 and operator-infrastructure analysis, and collaborates with independent researchers. Already cited by a published entry on 2026-07-25 (Thailand Ministry of Finance / Hermes AI agent), which is what prompted tracking it as a source rather than only as a citation. Promote to active after 3 contributing runs. | 2026-08-07: contributed indirectly, S3 traced a Zimperium 'Flying Eagle' Android-RAT post back to hunt.io as the 2026-07-28 primary and dropped the rehash in favour of it, then re-proposed hunt.io as a candidate not realising it is already tracked. Counts toward the 3-distinct-run promotion bar; already-tracked, so no new candidate was added for it. | 2026-10-04: `extract` returns the crawl date as date: on every post; use `url https://hunt.io/blog` for slug order and WebFetch per candidate post for its displayed date. | 2026-10-21 (2026-10-21T0256Z-intel, S3): WebFetch on https://hunt.io/blog returns the ten newest posts with displayed dates and absolute URLs in one call; `url` returns a ~12 MB shell and `extract` of the listing mostly older cards.