Security researcher and infrastructure engineer with deep expertise in adversary tradecraft, malware reverse engineering, and threat actor intelligence. I build, operate, and defend systems under real attack — not in a lab. My infrastructure autonomously classifies, geo-attributes, and blocks nation-state and criminal actors in real time, correlating honeypot telemetry, fail2ban jails, SSH tarpit data, and global threat feeds into a unified kill chain. Over 3.4 million IPs permanently blocked. Live 24/7.
I grew up immersed in online communities, forums, and multiplayer gaming environments — spaces where social engineering, deception, and trust exploitation happen in real time. That early exposure taught me something most people learn the hard way: the biggest vulnerability in any system is the human element. It's what drew me to Open-Source Intelligence (OSINT) investigations, digital footprint analysis, and understanding how attackers weaponize publicly available information.
Today I conduct independent security research, malware reverse engineering, and dark web operations to study adversary tradecraft and threat actor behavior. My research extends into domestic and international terrorism — including radicalization pipelines, extremist network infrastructure, and ideological threat actor ecosystems studied through an intelligence-collection lens. I am trained in the FEMA/NIMS Emergency Management Framework and hold multiple FEMA certifications covering incident command, national incident management, and national response operations. I maintain a personal cybersecurity lab running Linux environments and security tooling for hands-on analysis. KEVSEC is the operational platform I built end-to-end: automated threat blocking pipelines, multi-source intelligence aggregation, live honeypot systems, and a unified dashboard that surfaces what matters in real time.
My professional background spans enterprise IT support, physical security infrastructure, and AV systems — including serving 3,000+ customers across major corporate campuses, supporting a $100M facility launch, and training end users adapting to new technology platforms. Known for translating complex technical concepts into clear, actionable guidance for non-technical stakeholders. Highly curious, investigative, and driven to solve complex technical problems. Prior member of CBRE's Rising Professional Organization and certified first responder on the Emergency Response Team.
CVE-2024-3400), Ivanti Connect Secure (CVE-2025-0282), F5 BIG-IP (CVE-2023-46747), Citrix Bleed, MOVEit, Exchange ProxyShell, Confluence, VMware vCenter, Fortinet FortiGate, WordPress, cPanel, phpMyAdmin, Jupyter, Kubernetes API, AWS IMDS, HashiCorp Vault, and more. Each fake panel logs the probe, fires an nftables ban, and reports to fail2ban. Events are enriched via bgp.tools + ip-api.com for state-actor attribution — catches Chinese operators routing through Western VPS space.
custom.meta.tsv → merged with external feeds (Spamhaus DROP, blocklist.de, FireHOL Level 1) → compiled into nftables sets atomically. 3.4 million IPs blocked without a single firewall rule per IP. Every morning, a Discord DM report delivers newly-banned IPs with ASN, country, and state-actor flag. A Cloudflare-aware filter prevents banning CDN proxy IPs.
Real-world, production-proven capabilities — not just certifications.