AI Weekly Malaysia

Trellner Research tested Perplexity's sonar and sonar-pro models across 380 software categories and found 59.8% of 7,534 citations point to domains ranked worse than #100,000 in the Tranco top-1M list, with 23.4% not in the top million at all. Three sites—none existing before December 2023—published 215,128 machine-generated 'best <category>' pages between them, two even titling their homepage 'Facts & Grounding Page' to target the retrieval step these models perform.

Why: If you ship AI-powered product recommendations or rely on Perplexity for buying decisions, a significant share of the grounding sources are content manufactured specifically to be read by models, not humans. Builders should audit their own retrieval pipelines for citation provenance and domain quality, and users should treat Perplexity's 'grounded' software rankings with skepticism—especially in long-tail categories where the cited domains are newest and least established.

A Chinese-speaking cybercrime cluster dubbed 'Gambling Goblin' has been installing malicious Apache modules on compromised Brazilian government and educational web servers since mid-2025, reverse-proxying visitors to fake app-store phishing pages that push online gambling sites. Check Point Research reports the modules strip security headers and leverage high-reputation .gov.br domains for SEO manipulation. ANY.RUN separately identified 20+ compromised .gov.br portals in a related campaign it calls PhantomEnigma, noting these hosts are part of the delivery chain rather than the primary targets.

Why: If you operate Apache web servers, this illustrates a real server-side compromise chain where attackers install malicious modules that transparently reverse-proxy your traffic — meaning your domain's reputation is weaponized without obvious defacement. The toolset includes 3snake, which uses ptrace on sshd/sudo processes to extract password strings, plus an SSH brute-forcer — a reminder to audit what modules are actually loaded on your Apache instances and to restrict SSH access rather than relying on password auth.