Hello, I am a friendly(-intended) scanhost used for defensive purposes (not offensive --- ever).

Ongoing test (2021-12-10 to present): Probe for log4j RCE. If you see requests from this host that contain a hostname ending in `.dns.cyberwar.nl': don't worry, it is a harmless test. If the request resulted in a DNS lookup, your system might be vulnerable. In that case, you have or will receive a notification. (Alas, no divd.nl subdomain was readily available for these tests; hence a personal domain was used.)

• No actual attacks will originate from me, only probes.
• Collected data will ONLY be used for education/research and incident response via trusted (TLP:Amber) realms.
• My operator is a volunteer researcher at the Dutch Institute for Vulnerability Disclosure (DIVD): see https://divd.nl/team/

My operator can be contacted at koot@uva.nl or @mrkoot (Twitter).