Additional NinjaRMM Domains and URLs

Threat Intel
1

I came across a random MSSP with a KB page on the required allow-list for them to utilize NinjaRMM. If your org isn’t a NinjaRMM customer, these would be good additions to block.

https://kb.syscon-intl.com/knowledge/what-is-ninja-monitoring

US instance

*.ninjarmm[.]com
*.ninjarmm[.]net
*.rmmservice[.]com
ninjauploads[.]s3.amazonaws.com/app.ninjarmm.com*
ninjaresources[.]s3.amazonaws.com/AgentBinaries/patchmgmt/
ninjabuilds[.]s3.amazonaws.com/

NinjaRMM is also extremely aggressive in their email campaigns to non-IT users; you may want to check your SEG for this behavior.

And here’s their socials:

.instagram[.]com/ninjaone/
.linkedin[.]com/company/ninjaone/
.x[.]com/ninjaone/
.facebook[.]com/NinjaOne/
.discord[.]gg/ninjaone/
1 Like