Contact

Questions, corrections to published intelligence, and research contact: email is fine. For anything about your feed access, write to feeds@knownexploited.com. Sharing samples, logs or infrastructure? If sending it could put you or your organization at risk, read the note at the bottom first.

Signal: knownexploited.90
Preferred for anything sensitive. Signal usernames don't reveal a phone number to either of us. Set disappearing messages on.
Email: tips@knownexploited.com
Fine for routine contact. Assume the metadata — who wrote to whom, and when — is visible to others even if the body is encrypted.

If you're taking a real risk by contacting me

Be honest with yourself about your threat model before you send anything. None of the channels above make you anonymous to me, and none of them hide the fact that you contacted a threat researcher from someone who can see your network or your device.

If the risk to you is serious:

Contact me from a device and network that isn't your employer's and isn't your own — and not from an account tied to your name.
Don't take documents you aren't authorised to have before we've talked about how to do it safely. The act of collecting them is often what gets detected, not the sending.
Read the Freedom of the Press Foundation guides and the CPJ digital safety kit first. They're written for exactly this moment.
Access Now's Digital Security Helpline gives free 24/7 support to journalists, activists, and civil society. You can talk to them without talking to me.