Noel Mendoza

To measure my passive exposure across open internet channels using adversarial recon methodologies. The scope spanned public domain records, historical username reuse, breached credential hashes, metadata in legacy document uploads, and automated people-search scrapers.

• Username Enumeration: Queried cross-platform handle presence using custom Python scripts and Sherlock/WhatsMyName against 400+ services.
• Data Aggregator Recon: Audited records across LexisNexis, Whitepages, and FastPeopleSearch to identify phone, address, and relative linkages.
• Exif & Metadata Inspection: Extracted EXIF geotags and author usernames from archived PDFs and image uploads via ExifTool.
• Breach Analysis: Cross-referenced historic personal identifiers against HaveIBeenPwned and DeHashed indices to isolate compromised passwords.

Enforced strict compartmentalization: submitted CCPA/opt-out removals across 28 data broker repositories, transitioned accounts to unique email aliases using SimpleLogin, replaced shared usernames with randomized handles, and configured automated Google Dork alerting for new indexations.

Conducted purely for defensive threat intelligence research: modern cyber threat actors and disinfo campaigns heavily leverage AI-generated personas (sockpuppets). To identify them effectively, defenders must understand the technical correlation vectors that give them away.

Built a fully contained fictional researcher identity, including synthetic profile imagery generated with latent diffusion, structured backstory timeline, and LLM-assisted linguistic phrasing.

• Linguistic Stylometry: Frequency analysis of sentence length, comma cadence, and idiomatic markers revealed telltale AI tokenization patterns.
• Activity Temporal Mapping: Posting timestamps revealed rigid operational hours inconsistent with the persona's purported timezone.
• Image Artifacts: Subtle symmetry errors in earlobes, hair borders, and non-repeating background specular highlights detected via frequency domain analysis.

Identified key heuristics that investigative analysts can apply to unmask automated disinformation and threat actor sockpuppets without relying on platform telemetry.

A granular threat intelligence teardown investigating exploitation patterns targeting unauthenticated input deserialization in edge services. Traced the campaign lifecycle from initial vulnerability scanning to interactive command-and-control (C2) persistence.

• Initial Access (T1190): Exploit Public-Facing Application via crafted HTTP POST payload bypassing front-end WAF inspection.
• Execution (T1059.004): Unix Shell spawning child process under web daemon UID.
• Persistence (T1053.003): Scheduled Task / Cron modification writing base64-encoded curl stage-2 payload.
• Command & Control (T1071.001): Encrypted outbound DNS tunneling beaconing periodically to drop hosts.

Authored Sigma detection rules to flag anomalous child processes spawned by web server daemons (`nginx`/`apache` launching `sh` or `curl`). Provided iptables egress filtering templates to prohibit unauthorized outbound socket connections.