Chris & Mickey | Relay Scanner

Date: 2026-07-02 2:25 PM ET

Attendees: Chris LaFay (Classic City), Mickey Mellen (GreenMellen Media)

Duration: 33 min

---

Chris LaFay: Hi.

Mickey Mellen: Oh, I see what the problem is. You're wearing the wrong shirt.

Chris LaFay: Right? Exactly. Yes, that. That right there. Like, I'm not in my, like, on state.

Mickey Mellen: Why are you spending money on frivolous clothing? That's not. You know what?

Chris LaFay: It's not a bad idea. I should just. I should literally just ditch my entire wardrobe and just have like 18 orange shirts that I just rotate through. There we go.

Mickey Mellen: Yeah.

Chris LaFay: Oh, my gosh. I. I would be. I would be so bored. So bored. I gotta at least have black. It's like orange and black. Like.

Mickey Mellen: No, not bored. Your brain would be freed up for higher level things. It's like Zuckerberg and Jobs. That's why they do it.

Chris LaFay: Like the CMS that I built for myself over the last five days. Yeah, that too.

Mickey Mellen: Oh, nice. Oh, cool. All right. Nice. Yeah, that sounds smart. I mean, sounds like it's on track, but. Yeah.

Chris LaFay: That was one of those sarcastic things I felt like I've ever heard in a long time. That sounds smart.

Mickey Mellen: No, it could be good, though. I could see we'll have to check that out at some point.

Chris LaFay: Yeah, it. It's a good. It was a. It's a fun brain exercise. Oh, for sure. Yeah. Like, I realized I had all the building blocks already coded out and I had basically everything in, like, data objects. I was like, building a CMS on top of this would actually be painless. It's already there, right?

Mickey Mellen: Yeah. Now the big revelation I had, I was listening to a podcast. They were talking about vibe coding, sharing some of the projects, but I guess could be interesting at the end. He said, if you're new to vibe coding, don't get overwhelmed. Start with something easy. Do like a chrome extension. It's super easy to build a chrome extension with Viper. And, like, really? I always shied away from them because I figured it'd be a pain. Yeah, no, it's super easy. Oh, yeah. Even in lovable, it's probably. It's easier in hpk. But even lovable, like, one prompt, it got it working perfectly the first time.

Chris LaFay: Is that how you're doing some of your, like, LinkedIn crawling and stuff like that?

Mickey Mellen: No, I need to play with that later. I'm not. This is just a read it later kind of thing. Like when I click in a story, it saves it, puts it like, yeah, rss.

Chris LaFay: I saw you make a note. I saw you made a note of that somewhere. I don't know where, but yeah, interesting. That's cool.

Mickey Mellen: But I've been spending all my dollars on a relay scanner, so.

Chris LaFay: Yeah, show me.

Mickey Mellen: So let's see. Yeah, lots of changes. Let's see. I'm not sure where we start, but. Okay.

Chris LaFay: And by the way, I'm very sorry that I just completely ghosted you. That was not all good.

Mickey Mellen: I'm glad you're not dead. So that's good. Like, it's not like chris. So this is not good. Like, I'm a little nervous.

Chris LaFay: So, yeah, I went to. I went from, like, days of, like, back to back to back to back to back to back to backs. Because I was gone for two weeks to a day that was just open.

Mickey Mellen: Yeah. Nice. Get some work done.

Chris LaFay: Yeah, exactly.

Mickey Mellen: Yeah. My morning was open. My afternoon gets bonkers here. But that's all right. I've got some time right now, though, so. All right. So it looks basically the same. I mean, there's not a whole lot of changes there. A few big differences. There's no longer the counties. It now just does it by state automatically. So if you wanted to filter, which I don't. I almost never go in there, though. That's just. If you wanted to filter by state. Yeah, it's like. If you want to find your stuff, you can just filter by, like, Gwinnett Chamber, and it'll filter those in after a few seconds. So that's how you can find those still. Because they were all tagged with that. Then I added, let's see, you can sort. So I do, like, let's see. Going across. So 11,000, 516 WordPress sites.

Chris LaFay: Where did you find all those? I think, as you said, 20,000 at first. I'm sure it filtered down to 11,000. Well, you got rid of Squarespace.

Mickey Mellen: There's 26,000 that are not WordPress. So 37,000 I've added so far.

Chris LaFay: So. Yeah.

Mickey Mellen: Although more because early on, if it was not WordPress, it discarded it. And I realized, no, you know what? I want to keep it just tucked away, so that way when I add a new batch, it can quickly get out the dupes versus rescanning them again to see that they're not WordPress. So.

Chris LaFay: Yeah. Where did you find all these? Like, what is. What did you find so far?

Mickey Mellen: Yeah.

Chris LaFay: Wait, what'd you say? hpk.

Mickey Mellen: hpk. Yeah. Hey, hpk. Find me small businesses in Cobb County. Find me small businesses in Fulton. Find me other stuff in Tulsa. Find me churches across the U.S. find me non profits here. Just like, find me, like. And it would go off for an hour and just come back like, here's 13,000 churches. I'm like, all right, cool. And I Drop them in a couple thousand at a time. And, you know, so I think I'm gonna buy. There's a database I can buy. It's like 134 million businesses in the U.S. though, for, like, 500 bucks, I can always buy it.

Chris LaFay: And, you know, I mean, honestly, for 500 bucks, even if half of them are duplicates, you would still save.

Mickey Mellen: Oh, yeah. If they're garbage.

Chris LaFay: A ton of money in hpk. A ton of money in clogged credits.

Mickey Mellen: Yeah, my credits are being spent on. On this. But, yeah, all of this. Yeah, exactly. All right, so, yeah, so does that two contact. I changed the criteria for that. It used to be if they're above a certain score now, they either have to be hacked or have a security hole. Like, there's still too many even just with that. So, yeah, is that. Who have I contacted? 53 So far. Although also the slackers I've been contacted, they just have drifted into a different bucket. So those are ones that are over the threshold, hacked or whatever. And I contacted more than six days ago, and they're still in the same situation. So I need to get back to them again. Malicious are ones that are actively hacked. Now, I spend a lot of time in here. These are 34 sites that are actively hacked. My scanner was a little overzealous. It was picking. It was some deep cuts. I don't know if I told you about that, but, like, I reached out to a company and talked to the website. No, I promise, we're not hacked. And we dug in more, and he was not. But, like, this said it was hacked. I looked. It looked hacked. I have hpk. hpk said it was hacked, but if you dug really deep into, like, some weird tracking code for a thing they had. And he was correct that we're not hacked. So I spent a while fine tuning this, and it removed, like, 10 other sites that I thought were hacked, but I'm more cautious to make sure, like, I run it through hpk before I reach out. And then I'm like, all right, hpk, unpack that JavaScript, but tell me what's really in there. You know, it's like, oh, you're right. This is just a traffic thing.

Chris LaFay: So out of the 11,000 sites, only 34 of them have malicious code detected.

Mickey Mellen: Well, at this point, I mean, I fixed five or so, but, yeah, basically, yeah.

Chris LaFay: Okay, gotcha. Okay.

Mickey Mellen: But another 1800 are missing security updates, you know. Yeah, the malicious has dropped lower than I had hoped. To be honest,.

Chris LaFay: I was really hoping there were so many more people that just had Their. Their front doors of their house just wide open. And we can just go in and take all this.

Mickey Mellen: Exactly. And there are more in the archives. There are a handful that are malicious. These ones, like, a lot of these are malicious in here too, but they were like, they've lost their domain and it's just, you know, spam sites. There's probably another 35 that are malicious but aren't worth even pursuing. So there's an archive button just like, just like. Yeah, don't, don't keep. In my view, just. It's not. Not one worth pursuing. These are worth pursuing. Need scan. I gotta play with these. There's a few that just don't scan. Right. I gotta play with. These are, I think, all down right now, but I think they're legit. So I'm gonna come back to them again. I'll try them again later. And then the grand.

Chris LaFay: That's near me. The Grove Talk. Which one is the Grove Talk? Oh, yeah, that's literally like. Yeah, that's in my downtown. Yeah.

Mickey Mellen: I mean, they're undergoing scheduled maintenance, so I'm not sure if they are really or they're really down or what's going on, but yeah, interesting. I'll try them again later.

Chris LaFay: Sorry, I just wasn't expecting to see like something five seconds away from my house there. Cool.

Mickey Mellen: Well, you should. There's a lot of Gwinnett stuff in here still. I mean, still a big chunk of it, so.

Chris LaFay: Yeah, also true.

Mickey Mellen: And then you can sort by different things. So like, I go to malicious often, especially if I add like 2000 more sites, I'll go into malicious and then sort by vulnerable or name or by most recently scanned. So if I add like 2,000 sites and it's like, oh, three more malicious ones. Oh, what were the ones that were just scanned? It pulls them to the top so I can see what's going on for who's most recently scanned and try to deal with those. And then let's see, the other thing of note. Oh, yeah, I added tags because I had like a county for Green Melon clients and a county for Green Melon lost leads. Like. Yeah, that's not how you do that. So now you can. I can tag things. So like, here's the Green Mountain clients I can keep. Oops. Oh, they're non malicious. That's why it was under the malicious in Green Mountain. There's nothing there. So. Yeah, that's always good to see. Yeah. But then I like the green on past clients and past leads and stuff. I'm like, oh, I've reached out to some of these that are like, yeah, you all need some help because you turned us down and now you're hacked. So chat.

Chris LaFay: Hey, look at that. Huh? So nice.

Mickey Mellen: There's some of that. And then, yeah, I'm using the. This is where if you're going to use this much, you have to start using these. The little, like, logging and outreach. So you just click on this, type it and say what you did, Reach, emailed, whatever. So that way I can see that something happened on that one. And so I can see, like, the history of this. I can see here. I emailed Gary and Joan on June 29th. If it turns yellow, it means it's more than a week old. It's probably reach out again. But I can see here.

Chris LaFay: Great idea. Huh?

Mickey Mellen: And see here, I reached out to John Bennett. Reached out to John Bennett again. I'll probably reach out to him again. Yeah, he's a slacker. Whoops. Didn't click into it. Yeah, yeah. So almost all the malicious ones, if I don't have it tagged here, there's a few I gotta reach out to. Like, yeah, this one was a Gwinnett Chamber One Dynasty Pawn. So I don't know if you had reached out to me yet or not. Like, I didn't wanna.

Chris LaFay: I don't think I did. I don't think I did that one. I did. I did a few. I did about five or six. Then I got a couple of email bounce backs.

Mickey Mellen: Okay. So, yeah, so most of the rest I've reached out. There's a few I'm still missing. Another Gwinnett Chamber Optic usa.

Chris LaFay: That one's bad. I. I tried that one. I couldn't get. I couldn't. Hey, I couldn't find an email. I couldn't find people. I couldn't find anything about them.

Mickey Mellen: So. Interesting. All right, I'll try it later. I'll see. I'll see if I find anything. And then, yeah, a few others. Yeah, I just haven't gotten to them yet, but most of them, I have some kind of. Wow, More of these, Miss. Oh, I'm in all. I'm like, I swear I got. Yeah, most of the malicious.

Chris LaFay: Here we go.

Mickey Mellen: Malicious have reached out to almost all of them. Yeah, just a few missing in there. And I have the notes just for if you wanted little comments. Like, I asked Ace Patel if he'd pass it along, you know. Oh, hey, he never wrote back on LinkedIn. And then he never wrote back an email either.

Chris LaFay: So have you met Ace or have You.

Mickey Mellen: Yeah, I met him at Topgolf.

Chris LaFay: Yeah, he was at Topgolf. That's right.

Mickey Mellen: Yeah, the thing on LinkedIn and figure, okay, he's not a LinkedIn guy. So I emailed him and a week later and he still replied to that. So then ultimately I said, okay, ascent reply, LinkedIn. So I emailed him and then eventually I sent. So I have some cold. I'm measuring some AV testing stuff. So I sent cold email a. To intake at Iceberg Health just to see what that does. And nothing.

Chris LaFay: Yeah.

Mickey Mellen: Okay, that was yesterday. So yeah, we'll see what happens there. But yeah, but if you reach out to anyone yet, just make sure to just tag. Push a little button. Just, just put. Because I think it does it put my name automatically. Let's see. Yeah, yeah. So you have to say much. Just say reached out. You know, you can be super quick and dirty there. Let me pull that up.

Chris LaFay: I'll put one on Optic Health really quick and see if it. See if it works the same. I'm assuming it should, but it's good.

Mickey Mellen: Yes. Now this doesn't. I've had to do so much caching stuff now because there's 11, 500 active sites, so you sometimes have to refresh to get things to show up. Like if you tag it now, it won't auto. It won't do it like ajax. I'm working on that a little bit, but it's getting tough to keep that consistent with this many sites. Yeah. You know, and you can back date or forward date those things too. So if you reached out three days ago, you go in and click the calendar picker and pick a different date.

Chris LaFay: Okay.

Mickey Mellen: And then I think I told you. Okay, cool. Then I think I told you I added a. A thing where it also scans for. They're no indexed.

Chris LaFay: Oh, that's right. Where. Yeah, it's like we're like. It's actively, actively blocking Google.

Mickey Mellen: So here's 282 sites that are no indexed. Almost certainly all by accident. So.

Chris LaFay: Right. Yeah.

Mickey Mellen: And of course they also are. I guess it'd be nice to do like mixed. Mixed mix filters, but you can't really do it. But where I can see like missing security patches and no index. But most that are no index are also, you know, if you sort by vulnerable, you get to the top. So none. Well, actually I'm talking to them this afternoon, Candido. They came from a different lead and then I plugged them in here and like. Oh, crap.

Chris LaFay: They're.

Mickey Mellen: They have. They're hacked. They're Outdated by almost eight years. They have no analytics, no schema, no cookie banner, no index and copyright of 2019. Like. Yeah, okay, that could use some help. Yes.

Chris LaFay: That's great. This is great. We can definitely do this 100, maybe chat with them.

Mickey Mellen: So. Yeah, a lot of churches I had qualified me a bunch of churches just across the US A lot of churches in here. Which churches in general are a hot, stinky mess. Holy crap.

Chris LaFay: Oh yeah, they're absolutely horrific. Yeah.

Mickey Mellen: Yeah. So here's Zion ucc, no analytics, no schema, no cookie banner, no index, missing a security patch, outdated eight years, you know. All right, sweet. Yeah. But they're also no budget, so there's that too.

Chris LaFay: There's a. Yeah, they have no money. Yeah.

Mickey Mellen: So you can filter if you want to see old copyright, no cookie band or schema, ga or. Yeah, keep it on all second levels. Probably don't play with that because it'll get messy if we both are. But that's where I'm like tagging in who my second level connections might be. Like this one. If it has an X, it means I looked and I just don't have a connection anywhere. Yeah, that way I don't keep checking to see, but then I can look at others and those X there's there. Here I've got your top tier trees. Let's see Tom Schroes. But yeah, I reached out to Tom, never heard back. Never back from Tom. So I emailed Mandy and David directly, but that was. Yeah, four days ago. So interesting.

Chris LaFay: Yeah. Okay, I see this. Okay. Huh.

Mickey Mellen: So I'm hoping to get more as I start digging into slackers as they bubble up again. Say like, seriously dude, I'm a human. You're still hacked. Like, I know you probably ignored my first email fam. Like cool on you, but you still have problems. Like let's. Let's talk for real now. So I'm working on like what that follow up email can look like to maybe grant some attention. But most of these are interesting. Like local ones that are not hacked. They just have security issues. Like.

Chris LaFay: Yeah, yeah.

Mickey Mellen: And some I still need to weigh down. Like this one Local 3. JC actually knows them. So she said she talked to chris, the owner, in a couple of weeks. As of a few weeks. So I'm going to give her another couple weeks. But like he's got a bunch of sites for all his restaurants that are all like wildly out of date. Missing security patches. Copyright 2015. Like, but she's like, yeah, he doesn't like to spend money. I'm like, does he not change his oil in his car? Like, you know, come on.

Chris LaFay: So the restaurant groups would be a good. Would be a good place to get into for stuff like this. Because if they. One by one, they might not have individual money, but maybe the restaurant group owner owns multiple.

Mickey Mellen: Here's the four that this group owns. Like, okay, they're all like, Rochambeau's. Okay, not good. 20 Copy, 2015. All the rest are like very, very bad. Like, cool, I'll give you a bulk deal, you know, 150amonth each, or do all for 500 bucks. Like, let's go. You know, like, yeah, keep yourself in shape. We'll see it. She said she wanted. She knows him dearly and she'll. She'll get there eventually. So I'm not going to push her, you know, because again, they're not hacked. They're hacked. I'd push hard. Like Ali's pool company. Actually, what saved me there, it got. Had a new owner and she wasn't sure who it was. So I used Apollo like you said. And Apollo said, oh, it's Vance. Here's his email address. I emailed Vance, signed him up. Like, so. Yeah, it worked out great.

Chris LaFay: How many people have you. I mean, so. So you knew that person through Ali.

Mickey Mellen: But like, so far only have been ones I've known through. Through Connect. But because of the tool. Like, because the tool we found that. Yeah.

Chris LaFay: And I got like, how many new ones have you. How many new ones and what levels did they buy?

Mickey Mellen: Three sites. All just base maintenance. Actually, no, he bought. He ended up getting two sites because he's like, I have another site too. So there's that. So, yeah, I guess four sites. Because then there's like another buddy.

Chris LaFay: He.

Mickey Mellen: This is an IT friend of mine.

Chris LaFay: I told him you guys might have multiple.

Mickey Mellen: Yeah, he sent me like 80 sites. He's like, this is great. Let's see what you got. So I signed one of his camera. Which ones? Now they're not in the bottom here somewhere, but. Yeah, but they were hacked and they were messy. There's no one else hacked. Just some others that are troublesome. I've talked to a few others clients and they've not, you know, they're like, yeah, tell me about the cookie pop up.

Chris LaFay: We'll.

Mickey Mellen: We'll get that going. But they didn't really need help but had some conversations. So, yeah, I've got. I've done a lot where I've got like Tony Dodd, I've got like Alex, whatever edge agency. I can't remember her name off Alex, whatever. But. So she's been sending more. She's gonna send me more. Like, she's like, yeah, I'm gonna talk some of these folks. Like, she's excited to, like White Label. She's like, yeah, I'll charge 250 bucks a month. You charge 150. Let's go. I'm like, come on, let's go. She hasn't done any yet, but, yeah, she's got something to need it. Or Kristen at ID8. She's gonna send me more. She's still got one that's hacked. I'm like, y' all gotta get on them. Like, come on. And then a few that we manage for them already down at the bottom here. So. Yeah, but she's got a bunch that she can get. So I'm trying to do that angle between IT companies and, like, other agencies. You know, I did like Ryan and Reason. I talked to them a little bit, but they weren't interested in it because she said, I don't really know these. These clients anymore, the ones we have. Because I said, most gears are in good shape. I mean, it's some bad ones, but a lot of. It's a lot of zeros, you know? Yeah. Really good shape. Said, yeah, I don't know those other ones. And I'm like, we could reach out and be a good sales opportunity for you. Like, okay, if you don't want to, like, that's fine, because none of them are hacked. I mean, just, you know, so you do you boo. You know, so I've been. Yeah, I've got. I've got like 10 different agencies like, that I've been adding. Adding folks in just to try to see what I find. Mostly, like, with Alex, with Edge, with any of these. I've gone to their site to look at, like, their testimonials and case studies, found all the sites, plugged them all in, and then did a screencast saying, alex, here's like, eight of your clients, and here's what's happening.

Chris LaFay: And like.

Mickey Mellen: And she said like, holy crap. Here's like 10 more URLs. Plug them into like, okay. And then others have said, like, eh, that's cool. But, like, I talked to it friend of mine this morning. He's like, I'm not willing to give you addresses of my clients. We don't give out our client addresses to anybody. I'm like, all right, that's fair. But I mean, okay, if you have any one you're concerned about, I can run it in Here, I won't reach out to them. Like, I'll just give you a report. Oh, yeah. Because I added this now. So if you go to wherever Edge agency, filter it down a little bit, this will down. This will build a report. Like an ugly report, an unbranded report of all those sites at once. Oh, yeah. So if you do this in like for these 30, 30 sites here, it'll do this. So in order. So Southeastern Railway 81. Here's what's going on. NTECH71. It's got these issues here. Tuxedo, firewood, no cookie consent banner in a 66 Fellowship Bible. So, Alex, here's all your sites all in one spot. You know, and it's. And again, it's unbranded on purpose. So she can then go talk to him if she wants, you know.

Chris LaFay: Yeah.

Mickey Mellen: But then I still have the branded stuff. Of course, I still use a lot too.

Chris LaFay: You know, this is a really dumb thought, but this was actually one of the first things I thought about. I feel like the scores.

Mickey Mellen: I know. I thought. I've thought about that too. Yeah.

Chris LaFay: Because my. My. I was like, what. What is weird about this? Like, I'm not used to seeing a 99 as red. I'm used to seeing a 99 as like, green.

Mickey Mellen: Right. How risk. How much at risk are you? Is kind of the.

Chris LaFay: Of course, I could just say how.

Mickey Mellen: Safe it could be. How safe are you? And you're a 90 for safe and. Oh, you're only a three for like. Yeah, yeah, I could. But I've got enough people that are looking at this and like, the one client we landed, the Georgia pool. I gotta keep up with his now because I sent him the report. Yeah, there's a lot on Georgia. Oh, wait. Georgia pool. Pool. Probably a lot of pools. Oh, well, wherever he is, he's down here now somewhere. Where is he? Georgia Classic Pool. There we go. But now he has that report. He has this share report link and he looks at it a lot.

Chris LaFay: Oh.

Mickey Mellen: So of course it only updates when I update it. So, like, pulling the report doesn't run a rescan. So he keeps checking on things. But then when he said, here, here's my other site too, please add it. I'm like, cool, added it. He said, oh, can you send me the report link for it too so I can watch it? Like, okay. So I went and generated the report for him. So, like, that's just kind of interesting.

Chris LaFay: So did you tell him that it doesn't refresh?

Mickey Mellen: No, I'll just. I mean, they refresh often enough, I mean and we're not doing that much. He's like, it was nice to see it drop so quick already. He's not gonna be looking that often. So. Yeah, I was just gonna say there's another.

Chris LaFay: That's funny.

Mickey Mellen: Something else I've been to tell you too. Let's see, I was in pool, around the pool shoot. I'm also going to show you. But yeah, I mean that's basically. Oh, the bulk imports improved all the scanning. So if you obviously import or whatever, it runs it into a queue first where it kind of checks them out and see like it's like checking if they're in WordPress. You add 500 sites, you'll see it count up to 500 to see if they're WordPress or not. And then it drops them in the scan to actually scan them. But anytime you want, you can rescan sites in different ways. We could do like the malicious ones and I could say scan. I guess I can't scan that way. I've been changing how it works. But I can say you scan the missing one, scan the oldest scanned one's not scanning however many days or I thought it was. I've been playing with this a lot, so maybe I broke it. Maybe it has to be a filter from all. There we go. So if you pull, if you do something on a filter, say just scan these 30 from Edge Agency to get them fresh again. So like before I reach out to her again, she's how my site's looking. I pull up Edge before export the thing, scan all 30 and do a fresh scan on all of them. Because again, some of these are a few days old now or just from the main list. I can say this is what I do more often. Never going to click that again because that'll take forever. But I'll say like scan the oldest in the morning. Like scan the oldest thousand sites, like whatever has been scanned longest ago, scan them to catch so it looks to see what the oldest is. So like hell, I'll just do that. May as well I do that periodically.

Chris LaFay: Because again, how long does it take to scan one?

Mickey Mellen: I mean it does them in parallel. It does like eight in parallel. It'll do a couple hundred an hour. So yeah, not.

Chris LaFay: Not a couple hundred an hour. Okay, cool.

Mickey Mellen: Yeah, so this will, this will take it part of the afternoon, but it'll still be scanning off to the side and doing its own thing. And then some of those thousand will show up in the need scan because it's going to hit him like, oh, something broke this time. Like, these are all sites that have been successfully scanned before, but in theory. But now something broke. There's also a subset that my work isn't. WordPress scanner wasn't accurate. Because if, like, there's some sites that are not WordPress but they like, they pull their logo from a server that is WordPress. I was like, oh, it's pulling from WP content. So therefore it's a WordPress site. Like, no, no. So I got it, I got it fine tuned on that. But there's. So some of these will come up. Now I'm like, wait, wait, now it says it's not WordPress, but last time we thought it was. And so I'll go look at it and say, oh, it's really not archive and get rid of it. You know, do.

Chris LaFay: Does running individual scans cost you money or are you. Yes. Okay, so you don't. Okay.

Mickey Mellen: In multiple way. Yeah, it cost me multiple, multiple bits of money because it runs Fire Crawl. I have my Fire Crawl things. And then I also, if Firecrawl fails, I have scraping bee that is a little more expensive, but can break through more like cloud flare stuff to actually get a scrape of it. And then once it's done, it runs it through an AI thing with Gemini to see what it thinks for malware. Like, so it does a few things on each one because that's where there.

Chris LaFay: Are few that have actual. There are a few that have incremental costs to them. Gotcha.

Mickey Mellen: Yeah, I mean, they all do to some degree.

Chris LaFay: Yeah.

Mickey Mellen: I mean, every scan has it. But again, I get 100,000 scans a month on Fire Crawl. Like it's not. And again. Oh, okay, 20 bucks a month for that or whatever, you know, and then.

Chris LaFay: Individual tokens every time.

Mickey Mellen: No, no, no. Yeah, no, no, no. But I still probably spent a thousand bucks on this last month. I mean, because. Yeah, you know, because what's it called? Lovable is always saying, like, hey, you need to top up. And like, 50 bucks. 50 Bucks. Like, all right, take another 50. Like, it's like you're running out of AI credits. Running out of these credits. Like, whatever credits just keep going. But then what I'm often doing is like in here, like this says, this is hacked. And I can look in here like, okay, that's legit hack. Those are. Those are bad sites. Like, I can see that there. But there's some, I think of a good example. Most of the time I'll run it through hpk as well, just to see. I mean, that looks Pretty bad, probably. I'm. I'm quite convinced that's hacked, whatever that is. But I'll run it through hpk. Just say what I'll do, that is, I'll pull up the site. I found it easier to do this. I pull up the site and then view the source. View source and then paste that whole source and go to hpk, say, claude, is this site hacked? And paste in the whole source. And it'll either say, yes, it is, or no, it's not, or, no, it's not. Why do you think it's hacked? What makes you think it hacked? And I'll go in here and say, well, this said, this stuff. Like, you'll say, oh, it's a false positive. It thought this was wrong, or whatever. Or, you know, it'll say it's clean. You know, say, no, it really is hacked. You're right. I'll say, why do you think it's hacked? This is where I used to say, cool. It said it's hacked. It said, attack, it's hacked. But I push hpk a little bit more and say, why do you think it's hacked? Well, this JavaScript looks suspicious. Like, unpack that JavaScript. See what's in there. And then sometimes we'll say, yep, it's a hot mess. And something like, oops, that's my mistake. This is actually a weird tracking code from some tracking system. It's okay, you know, you could put a.

Chris LaFay: On that malicious code detected at the top. Right. You could put a copy button where it markdown format all of the stuff inside of here, inside this section, so that when you're doing your manual review, you don't have to go into each of these boxes and copy and paste.

Mickey Mellen: I don't do each box, I just grabbed the whole. But even then, I almost never have to do that. So I just do the. It'd be nice actually to grab the, like, copy source because then I wouldn't have to go to the site and view source. That would save you some time. That's a good point. That could be good.

Chris LaFay: Or it could actually do. You could actually do both. It could actually have like, copy source and copy malicious code.

Mickey Mellen: Okay, I like that.

Chris LaFay: So when you're doing your hpk prompt or whatever prompt.

Mickey Mellen: Yeah. I do the source first. And then depending how it comes back. Yeah.

Chris LaFay: Because when you're, when you're crawling the site, you can just have it grab the source for you. Like, you don't even have to have it go grab the source separately. Right.

Mickey Mellen: You just don't have to but it's. It tends to go quicker because sometimes it's not able. Especially if somebody's not able to crawl through cloud flare. And like, I'm like, just. Here it is. It just works, you know, that's.

Chris LaFay: What's the AI review notes down right below. It's right at the edge of your screen.

Mickey Mellen: Just AI kind of writes more. A little bit more English language. Not quite, but just more what it thinks is happening. Let's try and look for a cloud example real quick. I'm in a different window here. Just to show you what's been happening there. I've given hpk a ton of these. Look for that one. Hang on. What time is it? Oh, I gotta go in a minute. Dang. I can't find it now. Definitely. Okay, yeah. Like this one here. Let's see. And you, you're way ahead of me on this, I'm sure anyhow. But let's see. hpk.

Chris LaFay: I also spent like 30 hours building a CMS.

Mickey Mellen: I know. I was gonna say, yeah. So I said, claude, this ain't hacked. Because my thing said attack. I said, is that hacked? It's suspicious. This is a big red flag. And something was like, yes, it is. Here's some normal things. This is a standout. What's going on? Want me to fetch that script? I said, yes. And oh, good news, it's not malware. It's actually call tracking metrics coming from CCTM xyz. Which is why, like, why are you pulling from that stupid, like. No, but again, it was able to do that. And so a lot of these sometimes too, I'll. I'll grab the file for it because, like, it can't pull the JavaScript file sometimes because that's got blockers on it. So I'll pull up the JavaScript file, see the code, paste the code in, and say, is this really infecting? It's like, yep, here's what's going on. Here's the things that are infected. And then. Yeah, so you see my, my cloth searches on the left here. It's just.

Chris LaFay: Yeah, you just. The only thing you do cloud for is just asking it about security flags.

Mickey Mellen: That's it.

Chris LaFay: Yeah. Nothing else.

Mickey Mellen: Yeah, yeah. There are times where it's like, yeah, it definitely is infected. Oh, yeah. Like this one here. This is a perfect one. Here's a few things that stand out. It says, you want me to pull up more info about these? I said, yes. It says, confirm this is actively flagged as malicious. This is sandbox, like all this stuff. I said, I'm told that this is a legit site. It's worth being skeptical for these reasons. Why don't we look more. And then eventually it came down to like, someone says part of this. He says, yeah, that clean pushback, I think it's still hacked. Like, come on, what does it actually serve? And eventually came down to like that confirmed. It definitely resolved this. Clearly this is the check platform, not malware. Like after he told me like six different prompts before, this is definitely malware. Like, this is the one where the guy said, like, my site's not malware, I promise.

Chris LaFay: Oh, I see. Yeah, yeah, yeah.

Mickey Mellen: Because I told. He was very nice. I told the guy, I told the guy, like my scanner says it was. It looked to me like it was. I checked with hpk, I said, yeah, I get it, dude. Like, but it's not. And this is where. Yeah, this definitely confirms it's not malware. Even though up here it said it is. It is, it is, it is. Like so and so. I'm using this then to like feed into my thing to help improve the quality. So the scan on mine is getting pretty tight again. But I'm trying to, I don't want it to be too suspicious. I'd rather flag it as malware and be wrong than skip right.

Chris LaFay: Yeah, exactly.

Mickey Mellen: Especially because I'm getting fewer and fewer that are as I get it tightened in again, 34 or whatever is not a lot, but again, drop in a thousand a day or 2,000 sites a day and pick up five more that are malicious. I mean, that's going to give me more than I can handle.

Chris LaFay: So yeah, yeah.

Mickey Mellen: And I'm still hoping my follow ups start seeing more as I reach out to these people a second and third time saying, hey, I swear to God, you're, you're hacked. And this is not just a random. And then eventually when I start sending them paper things, because my thought is I'll email them and if I don't hear back, fraud, then I send them the field guide and stuff in the mail. So can I try to reach out to you? You didn't answer, but I swear you're hacked. Here's more details about it. Like seriously, check it out, you know, and then follow up a week after that with another email. You know, I'm working on that. Yeah, I still gotta actually finish the field guide, but yeah.

Chris LaFay: Do you know where you're gonna get it printed yet?

Mickey Mellen: No, Ali's got that figured out. We're doing it through InDesign. She found it a way word about how to get it into InDesign. Like, it's 96 pages. I thought you have, like, layout, but indesign, you can flow text into it, which is nice. So once I get it done, she can just flow it all in. I'll go through. I can't use it that much. I'll do like, the page breaks and kind of get that. And then she can go in and like, make it as pretty as she chooses to make it. So, yeah, that should be fairly easy. And then there's a bunch of places to get them printed. So.

Chris LaFay: Yeah, speaking of design, we need to think about the conference and starting to actually, like, actively advertise for it. Did you can. Did how. Allie confirmed that she liked the speaker cards that I designed. It was a long. It was a while ago.

Mickey Mellen: I know. I. I think so. Yes. I'm not sure. I know she didn't like him at first because they weren't like, on brand enough. And I sent you other stuff. I think you re. Redid one. I did.

Chris LaFay: So the Amy. The Amy Blum one. I didn't copy that one. The one that. The one. The two that I sent you were basically the same as what you had last year. They're probably was a smidge different, but I also created a. There was one that was almost exactly identical and then the. There was a second one that was more about the speaker's topic than it was about the speaker's face. And so that would be something that, like, we could give to the speaker and be like, hey, Tim, here's your thing that talks about the topic that you're talking about, not just an advertisement of your face.

Mickey Mellen: Yeah, soon. But I do need to run now, though. I have a call in one minute. Yeah, the one notes leaving with. Yeah, go add calendar remarks if you do anything in relay, just so I know, so we don't double up on folks, but I'll go hit some of those other. That one Gwinnett one later, once I have a chance. See if I can't find a contact somehow or another and then get ignored. So that'd be great.

Chris LaFay: That sounds good.

Mickey Mellen: Appreciate it.