Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
REEF SENTINELDAILY CYBER NEWS & THREAT INTEL
Daily cyber news, live threat intel and exploited CVEs.
Self-hosted, hardened, and yours.
Chat with a model on your own hardware via Ollama or any OpenAI-compatible server. No cloud, no key.
Automatic daily intel from CISA KEV, NVD & GitHub advisories, a live cyber threat map, and your own notes.
Articles and updates on pentesting, AI, and cyber — with embedded video, including YouTube. Post your own.
Runtimes, models, MCP servers, agents, and a full security & pentest tooling section.
Write, edit, publish, and share articles backed by a real database and your account.
Threads and replies across categories from Models to Hardware to Security.
Curated AI and security GitHub repos, plus a shelf for pinning your own.
Agent starters, RAG scaffolds, and defensive security & VAPT report templates.
Runtimes, models, MCP servers, agent frameworks, and a security & pentest tooling section — all links out to the real projects.
Talk to a model running on your own machine through Ollama or an OpenAI-compatible server — your prompts and the model's replies always go straight from your browser to your local model, never through a Reef server. Attach files for context, and pick up saved chats where you left off.
A spec-based compatibility advisor — tells you which local models your hardware can run well, which will be slow, and which to skip. Connect to Ollama below for a real, measured speed test instead of an estimate.
If a local model server is running, this cross-references the table above with what you've actually got loaded — and runs a real, measured speed test instead of an estimate.
A browsable catalog of AI models across providers — context windows, pricing, and capabilities.
Latest threats pulled automatically every day from CISA's Known-Exploited-Vulnerabilities catalog and NVD — plus threat intel you post yourself.
Attacks happening right now, all over the world.
Click any dot, feed row or table row to see that IP's profile.
Loading…
Network-level attacks (DDoS) aimed at Mauritius, by method. They try to knock servers and networks offline by sheer volume.
The ports or services these floods aimed at aren't published.
Exploitation attempts caught by decoy servers in Mauritius, by the weakness attackers tried. Counts are attacking IPs.
This counts attacks coming from Mauritius, not attacks on it: IPs in Mauritius that servers elsewhere reported for attacking them. Usually zero or one; when it rises, it's often a hacked local server or router.
Ports most targeted across a worldwide network of sensors .
Ranked by how many separate sensors they hit. Click a row for its profile.
| IP | Country | Network | Sensors hit | Reports |
|---|
The weaknesses attackers tried most against decoy servers around the world, counted by attacking IPs.
Countries hosting the most malware servers. Click one to show it on the map.
Share of attack traffic from one country to another. Thicker, faster streams carry more. Particles show volume, not one per attack.
Every 15 min · published 1–2 h behindAn attacking IP that servers around the world reported in the last minute, placed where the IP is. Its targets aren't published, so there's no line.
Every minute · shown about 1 min behindIP locations are approximate (city level at best) and show where the machine is hosted, not who controls it.
Approximate · city level at bestMalware servers: machines that hand out malware or control botnets, reported in the last 24 hours. They don't attack you directly; infected computers connect to them.
Every 30 minDecoy servers around the world record every attempt to exploit a known weakness, so these counts show what attackers are really trying and where they come from.
Daily · previous full day, and last 7 daysArticles, guides and updates on pentesting, AI, and cybersecurity — with embedded video. Add your own, including YouTube.
Loading…
Questions, answers, and talk about running AI locally.
Curated AI and security repos, plus your own pinned shelf.
One-liners, configs, and advice worth keeping — shared by everyone here.
Starter files served from the API — AI agent scaffolds plus defensive security & VAPT reporting templates. Click to download.
Follow threat actors, malware, CVEs and vendors — we tell you when a new report, CVE record or exploitation alert mentions them.
Threat actors, malware and tools — their attack techniques, Reef Sentinel coverage and indicators of compromise.
Paste an IP address, domain, URL, file hash or wallet address. Defanged values like evil[.]com work too.
Curated threat write-ups, advisories and analysis — with cover media.
Step-by-step guides for running local AI, using the console, and tracking threats. Admins can add their own.
Direct links to the official homepage/download page for well-known cybersecurity, penetration-testing, and local-AI software. Always verify checksums/signatures from the vendor before running anything.
Answers to common questions about Reef Sentinel, plus a formatting guide for posts, articles, and comments.
Commands you can type into the body of a post, comment, or reply — no HTML needed. Comments and short replies only support bold, italic, and inline code.
Questions, feedback, or a security disclosure? Reach us directly, or send a message and we'll get back to you by email.
Build an engagement, add findings with a live CVSS calculator, and generate a branded, print-ready report.
Passive OSINT lookups for the recon phase of an engagement, plus offline hash identification and a payload cheatsheet.
Reads a website's HTTP response headers to identify its framework and server, shows any known CVEs for the exposed versions with details, and recommends what to do.
Manage everything shown on the site — news & videos, posts, homepage headlines, and subscribers. Admin only.
SMTP on ports 25/465/587 is blocked outbound by some hosts (e.g. DigitalOcean droplets by default) — Resend and Brevo send over their HTTPS API instead, so they work even then. Only the selected provider is used to send; the others stay saved but idle, so you can switch back any time without losing settings.
Get a key from resend.com/api-keys. Uses the "From address" below as the sender — it must be on a domain you've verified with Resend.
Get an API key (not an SMTP key) from app.brevo.com/settings/keys/api. Uses the "From address" below as the sender — it must be a verified sender in your Brevo account.
"From address" and "Site name/URL" are shared by SMTP, Resend, and Brevo — they control what recipients see, regardless of which provider is active.
Sends through whichever provider is currently active above. Save your settings first if you just changed them.