nopatience, to random
@nopatience@swecyb.com avatar

NoName are going bananas with DDoS-attacks against Finland since a few days ago.

Sup?

Old97Wreck, to Rap French
@Old97Wreck@todon.eu avatar

La 1ère mixtape de Noname, un p'tit bijou hors label (2016)

"Mama say she love, love, loved us
When the lights was off we had to stay with cousins
Granny at the BBQ with petty ass husband
Summertime, city life, Chi-town, my town, my town"

https://youtu.be/eSX7LmESZQ4?feature=shared


codefiscal, to random French
@codefiscal@mastodon.social avatar

The Bot does not catch the .lu (etc.) victims from this group https://t.me/s/CyberArmyofRussia_Reborn/7037 cc @GossiTheDog

avolha, to random Polish

Dawno nie odpalałam Telegrama, ale Kevin Beaumont zamieścił u siebie taki screen, że aż musiałam sięgnąć po oryginał - oto grupa NoName057(16) chwali się, że wypuściła na rynek własną partię "inteligentnych" szczoteczek do zębów zainfekowanych złośliwym oprogramowaniem DDoSia 😂​

#NoName nabija się, rzecz jasna, z tego "ataku": https://zaufanatrzeciastrona.pl/post/nie-3-miliony-szczoteczek-nie-wziely-udzialu-w-ogromnym-ataku-ddos/

Wpis Beaumonta: https://cyberplace.social/@GossiTheDog/111918965799091191

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

NoName057(16) are targeting the UK today, so I shall start monitoring them and naming their targets and attack types.

Their targeting: https://raw.githubusercontent.com/GossiTheDog/Monitoring/main/NoName/targets_2023_12_07_11am.txt

Currently:
pa.eastcambs.gov.uk
politics.leics.gov.uk
www.liverpool.gov.uk
www.mil.be
www.bollington-tc.gov.uk
www.cranbrooktowncouncil.gov.uk
cert.be
my.swiftcard.org.uk
www.monarchie.be
www.premier.be
www.david-clarinval.be
www.dekamer.be
www.senaat.be

#threatintel #noname

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

I don't know why #NoName have done a week of attacks on Spain, normally they swap countries each day. They claim on Telegram it's in support of Spanish farmers, but.. uh.. I dunno how that benefits their stated goal of supporting Russia. Also they claimed people were running their DDoS from toothbrushes this week, soooo.

It probably doesn't help that many of the targets after 5th February appear to have no cloud WAF, so fall to DDoS really easily.

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

It’s likely Italy - they started DDoSing targets there last night. #NoName #threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog, (edited )
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, Italy

C2 193.233.193.65 - HUIZE TELECOM

www.bper.it
www.bologna-airport.it
www.camera.it
www.atm.it
accesso-privati.credem.it
www.borsaitaliana.it
www.bccroma.it
www.bicipa.it
www.anm.it
alfabeto.fideuram.it
www.ansa.it
www.camera-arbitrale.it
richiestamodifiche.adm.gov.it
iampe.adm.gov.it
telematico.adm.gov.it
stdru.adm.gov.it
concorsi.gdf.gov.it
www.gdf.gov.it
www.consob.it
www.aiaf.it
www.assosim.it
www.agcm.it
anasf.it

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_02_12_11am.txt

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, Italy again.

They're having an Italy week, using the farmers to piggy back on again.

C2 193.233.193.65 - HUIZE TELECOM

www.giorgiameloni.it
www.sinfomar.it
www.amat.pa.it
amat.cloud.eleagol.it
www.amt.genova.it
www.sienamobilita.it
www.gtt.to.it
www.ctmcagliari.it
www.anm.it
intra.anm.it
www.trentinotrasporti.it
www.atb.bergamo.it
group.intesasanpaolo.com

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_02_13_10am.txt

#threatintel

GossiTheDog, (edited )
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets - why not have 5 countries.

New C2 5.252.23.100 - fake London VPS company again

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_02_20_12pm.txt

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, Ukraine and Japan. 2 year war anniversary.

New C2 38.180.101.98

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_02_22_11am.txt

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

I stopped #NoName monitoring and disruption over a week ago as I’ve been too busy.

I’ve just noticed from telegram they don’t appear to have had a public client since Friday, apparently somebody else has been taking down their C2 servers. Good.

#threatintel

GossiTheDog, (edited )
@GossiTheDog@cyberplace.social avatar
GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, Denmark again.

www.toldst.dk
www.moviatrafik.dk
dinoffentligetransport.dk
ufst.dk
www.bornholms-lufthavn.dk
www.trm.dk
www.cph.dk
www.bane.dk
motorst.dk
gaeldst.dk
vurdst.dk
api.cph.dk
www.mitid.dk
danishshipping.dk
netbutik.postnord.dk
logistics.postnord.dk
www.kolding.dk

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_03_02_11am.txt

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, Denmark again. Essentially same targets but they've refined the DDoS config.

C2 193.17.183.123

www.toldst.dk
www.moviatrafik.dk
dinoffentligetransport.dk
ufst.dk
www.bornholms-lufthavn.dk
www.trm.dk
www.cph.dk
motorst.dk
gaeldst.dk
vurdst.dk
api.cph.dk
danishshipping.dk
netbutik.postnord.dk
logistics.postnord.dk

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_03_03_11am.txt

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName DDoS targets, this week they are "supporting the farmers" (lol) in Poland.

C2 193.17.183.123

pz.gov.pl
etoll.gov.pl
drogi.gddkia.gov.pl
kpd.gddkia.gov.pl
www.autostrada-a2.pl
flotis.pl
www.autostrada-a4.com.pl
enota.viatoll.pl
conadrogach.pl
a1.com.pl

Botnet config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2024_03_04_10am.txt

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

You can follow @NoName57Bot for real time #NoName updates if you don’t want to wait for me. #threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar

#NoName have moved Ddosia to a new Telegram group with a new bot.

Today they’re mostly attacking France. Botnet config: https://witha.name/data/2024-03-11_13-45-06_DDoSia-target-list-full.json

#threatintel

GossiTheDog,
@GossiTheDog@cyberplace.social avatar
  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • provamag3
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • anitta
  • Leos
  • tester
  • JUstTest
  • All magazines