Timestamps

If you're using an automated or just code-based solution to touch the target, taking timestamps is a must – the more accurate the better. If, like us just now, you manually entered a malicious snippet, simply the time after the discovery will suffice. Giving the time of discovery in UTC will save the developer who is fielding the report from doing a mental timezone conversion before analyzing logs, usages charts, and other monitoring tools.