Pratik on Pratik’s Localhost

From IOC Lists to Firewall Blocks: Building a Threat Feed Pipeline Without a Paid Subscription — Part 2

pratik.dabhi.4u@gmail.com (Pratik) — Sat, 08 Aug 2026 00:00:00 +0530

The first post ended with a blind spot.

Pramaan, an Argusoft SaaS application, was publishing the feed. Sophos was consuming it. The firewall was dropping known-bad traffic on the paths where threat-feed evaluation actually applied.

But on SFOS 21.5, bare DNAT-forwarded traffic was still the uncomfortable exception.

The validation firewall was later upgraded to SFOS 22.

The feed did not change. The Pramaan publishing flow did not change. The community sources did not suddenly become more intelligent.

The enforcement path changed.

And this time, the logs showed the line I had been waiting for:

Drop remote source match

From IOC Lists to Firewall Blocks: Building a Threat Feed Pipeline Without a Paid Subscription — Part 1

pratik.dabhi.4u@gmail.com (Pratik) — Mon, 29 Jun 2026 20:00:00 +0530

This started with a simple thought: we already trust community intelligence during investigation, so why are we not using it before the traffic reaches us?

No paid threat-intel subscription. No heavy SIEM licensing story. No fancy black-box appliance.

Just community feeds, a small publishing layer in Pramaan, an Argusoft SaaS application, and proactive blocking at the firewall.

The result was not small. On traffic paths where Sophos ATP (Active Threat Response) actually evaluates third-party threat feeds, the volume of threat items requiring triage dropped noticeably during the observation window. This was an operational before/after comparison on the same covered traffic path, not a formal benchmark, and it does not include the DNAT-forwarded path, which SFOS 21.5 does not evaluate for source-IP threat-feed matches in the same way as supported outgoing and firewall-destined traffic.

Atapi Wonderland, Ajwa, Vadodara, Gujarat — A Color Study in Chaos and Calm

pratik.dabhi.4u@gmail.com (Pratik) — Mon, 16 Feb 2026 08:48:00 +0000

I went to Atapi Wonderland expecting noise, rides, and crowd energy.

What I didn’t expect?
A playground of color theory, symmetry experiments, rustic textures, and sunlight behaving like a spotlight operator.

This post is less about rides — and more about light, angles, and observation.

From RSC to XMRig: Anatomy of a 28-Day Next.js Compromise

pratik.dabhi.4u@gmail.com (Pratik) — Sun, 08 Feb 2026 12:00:00 +0000

What started as “why is CPU hot again?” ended with a full kill-chain reconstruction: public Next.js RSC RCE exploit, in-memory shell, persistent toolers.cjs backdoor, then 28 days of Monero mining plus a dormant DDoS payload.

This is a technical, command-first write-up: what was observed, how it was validated, and how the findings were converted into durable detections.

Anatomy of a Cookie Heist — Reverse Engineering an Info-Stealer

pratik.dabhi.4u@gmail.com (Pratik) — Sun, 01 Feb 2026 10:00:00 +0000

What looked like a simple setup.exe turned out to be a stealthy info-stealer that stole Microsoft 365 session tokens from Chrome cookies — completely bypassing MFA. Here’s the full forensic breakdown.

Introduction
#

Suspicious login activity was observed from multiple geographic regions, inconsistent with known user behavior.

Resume

pratik.dabhi.4u@gmail.com (Pratik) — Mon, 01 Jan 0001 00:00:00 +0000

Pratik Dabhi
#

Technology Leader · Software Architect · Cybersecurity Practitioner

Gandhinagar, Gujarat, India
LinkedIn · Pratik’s Localhost

Profile
#

I work across software architecture, engineering leadership, and cybersecurity. My background is in hands-on .NET development, and I’ve stayed close to the implementation as my responsibilities have grown.