Russia Launches Paid 'Tochka Kontakta' Messenger for Inmates in SIZO and Correctional Facilities
Russia has introduced a specialized messaging service designed to connect relatives and friends with individuals held in SIZO (pre-trial detention centers) and correctional institutions. The platform, named «Tochka Kontakta» (Point of Contact), allows users to send text messages, photographs, video recordings, and voice messages to inmates.
Unlike conventional messengers, the service follows a strict pay-per-action pricing model. An electronic letter of up to 2,500 characters costs 35 rubles, while a short text message limited to 200 characters is priced at 3.09 rubles. Video messages are charged according to length: up to 90 seconds for 4.29 rubles and up to 180 seconds for 7.99 rubles. Voice messages cost approximately 7 rubles each, according to reports from the Telegram channel «Banks, money, two offshore».
In addition to individual message fees, the service offers paid content subscriptions. Users can purchase access to regularly updated thematic sections for 99 rubles per chosen category. The project’s official website states that the platform aims to help families maintain contact with loved ones serving sentences or awaiting trial.
The interface is presented as a standard chat application displaying text, audio, and photo exchanges, accompanied by explicit notifications about charges for incoming messages. Developers have announced plans to make the application available in all major mobile app stores, although rollout details have not yet been specified.
Information regarding the platform’s operator, the procedures for reviewing and approving messages, and the complete list of participating detention facilities has not been disclosed. The service effectively introduces a literal tariff system for personal communication, requiring users to carefully calculate message length and media duration before contacting an inmate.
Related articles
Hashcat Password Cracking: Why Complex Passwords Like Summer2026! Often Fail First
Password cracking tools such as hashcat and John the Ripper exploit predictable human patterns when generating candidates, allowing structured passwords to be recovered faster than truly random strings. The process relies on comparing computed hashes against stored values without needing to reverse the one-way function. Modern password storage uses salted, computationally expensive algorithms including bcrypt, Argon2id, sha512crypt and yescrypt to increase the cost of each guess. Different formats require specific hashcat modes, and parameters such as cost factors or memory settings directly affect cracking speed. WordPress 6.8 introduced bcrypt with SHA-384 preprocessing while older phpass records remain supported. Audits must preserve full hash records, verify modes on test data, and combine dictionaries, rules, masks and statistical models to measure real risk. After testing, organizations should migrate to properly tuned Argon2id and enforce long unique passphrases managed by password managers.
Why HTTP to HTTPS Redirects Fall Short: Risks of Exposed Requests and the Role of HSTS Preload
A simple HTTP to HTTPS redirect satisfies basic audit requirements but leaves the initial request fully exposed in plaintext. The request carries the full path, query parameters, and cookies lacking the Secure flag, allowing observers on open Wi-Fi or compromised routers to read or tamper with traffic before TLS begins. Modern browsers such as Chrome since version 90 attempt HTTPS first, yet legacy clients, explicit http:// links in emails, scripts, and failed HTTPS fallbacks continue to send unprotected requests. HSTS instructs browsers to use HTTPS after the first successful visit, yet the header itself travels over HTTPS and cannot protect the very first connection from a new device or cleared cache. Preloading embeds the rule directly in the browser, eliminating the initial plaintext request entirely, but demands includeSubDomains and a one-year max-age, making the change effectively irreversible for months. The article recommends verifying Secure flags on all cookies, ensuring single-step redirects to the same host, and testing HSTS incrementally before considering preload.
OSINT for the Lazy Part 18: Extracting Value from Wayback Machine Archives for Bug Bounty and Security Research
The article explores passive reconnaissance techniques using web archive tools to uncover forgotten endpoints, configuration files, and sensitive parameters without directly interacting with target systems. It highlights three command-line utilities—waybackurls, gau, and waymore—that query public archives such as Wayback Machine, Common Crawl, AlienVault OTX, and URLScan to retrieve historical URLs. These tools help bug bounty hunters and penetration testers discover old API endpoints, admin panels, backup files, and JavaScript with hardcoded secrets that may still be exploitable. Installation instructions, usage examples, and filtering options are provided for each tool to maximize efficiency and reduce noise in results. The piece emphasizes that all methods remain fully passive, minimizing detection risk while requiring proper authorization before any active testing. Advanced users are advised to combine the tools for broader coverage and deeper analysis of archived responses.
OSINT Investigation Exposes Fraudulent Russian Garlic Investment Scheme Masquerading as Local Production
An in-depth OSINT probe into a Russian agricultural investment project promising 50-70% annual returns from garlic farming has revealed a likely import arbitrage operation sourcing produce from China and Uzbekistan. The project claimed ownership of over 300 hectares of fields, a proprietary seed fund, and guaranteed sales to major retailers including Magnit, Perekrestok, Pyaterochka, and Svetofor, yet public records show minimal profitability and heavy debt. Financial statements from linked cooperatives indicated just 2.2% net margin alongside loans exceeding annual revenue fourfold, pointing to reliance on continuous new investor capital. Registry checks confirmed no financial licenses, no seed-breeding status, and actual cultivated land far below advertised figures. Import declarations and equipment registrations further indicated the operation functions as a repackaging hub for foreign garlic sold under private labels. The parent group has been placed on the Bank of Russia blacklist, with related sites blocked by Roskomnadzor while Telegram channels continue aggressive marketing.