Researcher profile
Josh Grant
Independent Security Researcher · Malware Analyst · Incident Responder
His background covers a wide range of the field: identity and access management, IDS/IPS and SIEM engineering, endpoint detection and response, incident response, threat hunting, detection engineering, digital forensics, OSINT, advanced persistent threat investigations, DDoS defense, malware analysis, and security architecture. He’s worked inside large financial institutions and engineering organizations, and inside much smaller ones too — which means he’s seen both what security looks like in a heavily regulated operation, and what it looks like when a team has to move fast with a fraction of the resources.
For six years, he sat on the first line of defense against distributed denial-of-service attacks. He’s spent many more investigating malware and intrusion activity directly, with particular depth in Windows malware and information stealers — though he stays deliberately platform-agnostic rather than specializing narrowly.
His approach to malware analysis leans on direct examination over automated sandboxing: static analysis, disassembly, debugging, decompilation, memory inspection, binary and script analysis, protocol examination, and controlled execution, as the case demands.
The goal is rarely just to understand one malicious file. It’s to reconstruct the whole attack path — how the intrusion started, how execution happened, what changed on the affected system, what infrastructure was involved, and which indicators and techniques are worth handing to other defenders.
The guiding principle is simple: follow where the evidence leads.
He treats assumptions as hypotheses to test, not conclusions to defend — and he keeps what he actually observed separate from what he’s inferred, and separate again from who he thinks is responsible. The aim is to reconstruct as much of the attack chain as the evidence genuinely supports, and no further than that.
Josh has worked across more programming and scripting languages than he’d probably want to count, and considers himself language-agnostic on principle: the language, the OS, the malware family — all of that is secondary to understanding what the code actually does.
He’s also spent years teaching — security and computer science, including Linux and LPIC-oriented material — and holds multiple SANS certifications picked up across different corners of the field.
Why WhatIsMyWebInfo exists
WhatIsMyWebInfo started as an awareness project, and it stayed one.
Years of responding to real incidents gives you a close-up view of what cybercrime actually costs people, and none of it is abstract. It’s people losing real money. It’s someone’s crypto savings gone in one bad afternoon. It’s ordinary, careful people quietly blaming themselves for falling for something that was built, deliberately, to be believable.
Modern cybercrime mostly succeeds by making a dangerous action look completely ordinary. WhatIsMyWebInfo exists to close that gap, even a little.
The utility and awareness sections are written for anyone — no security background required. They explain what your browser and the sites you visit can actually see, what those signals genuinely mean, where the real risk sits, and how the common attack techniques actually work.
The Research section goes deeper. Its investigations come from direct, hands-on analysis of real cases and real malicious activity — attack chains, indicators of compromise, infrastructure, techniques, and behavior, documented as thoroughly as the evidence allows.
No personally identifiable information, victim details, credentials, or internal organizational data get published — ever.
If this project helps even a handful of people catch an attack before it costs them something, make sense of what happened after one already did, or just feel a bit more sure-footed online — that’s enough. That’s the whole point.
Research principles
A few things guide everything published here:
- Follow the evidence. Never work backward from a conclusion.
- Confirm an assumption wherever that’s technically possible.
- Keep observed fact, interpretation, and attribution clearly separate.
- Reconstruct the full attack, end to end, whenever the evidence allows it.
- Pull out indicators and techniques defenders can actually use.
- Never publish anything personally identifiable or unnecessarily sensitive.
- Explain the technical findings so they’re useful outside the malware-research world too.
- Correct the record when new evidence changes the picture.
Reach Josh through the Contact page.