Unconfirmed, but “Iraqi” 313 Team is claiming credit for a massive DDoS. This group is likely Iran-aligned, and also likely supported by the Iranian MOIS, if not a direct operation from them.
They are calling the attack over, and threatening Cloudflare for intervening.
server check-in: failed: livepatch check failed: POST request to "https://livepatch.canonical.com/v1/client/7272bc574b56409280ddf7f421b3df26/updates" failed: Post "https://livepatch.canonical.com/v1/client/7272bc574b56409280ddf7f421b3df26/updates": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Monday morning and I’m still getting timeouts from update servers. Others are as well. Seems like something is still up and Canonical isn’t saying anything.
beamed[.]st → beamed[.]cc → bulletproof registrar immateriali[.]sm (IANA 50012) and ISP Materialism S.r.l. (AS39287). Also own immaterialism[.]net and [.]email. They offer domain registration at a flat rate and via JSON API, which are both correlated with high abuse patterns. The listed officer addresses are Registered Business Agent fronts, and the names are likely made up as they each only have the one office appointment.
Looks to be have been incorporated in the UK in 2024, 2 months before the [.]sm and [.]net came under current ownership.
The ASN looks to possibly be a case of '“ASN-Washing” - taking over an ISP/hosting company in order to either obscure current assets or organizational origins. Until February, ASN39287 was ab stract ltd, linking to abstract[.]fi. Coinciding with directorship changes in the UK corporation, ab stract’s assigned AS number and all its prefixes shifted over to Immaterialism over two days.
The ASN is operated by a Romanian S.r.l. (equivalent of an LLC). The UK paperwork has signs indicating possibly fraudulent filings in order to obscure its own origins.
I don’t think the booter service and the host/registrar are one in the same, but they’re both very bad, at first glance.
Created the same exact day as beamed[.]st and .su, and sharing the exact same specific cloudflare nameserver. Doesn’t feel like a coincidence, but have not investigated it yet.
A LOT of fucking around and literally just plugging random sketch domains into whatever I have access to as a learning process, but with the intent to form an actual, repeatable workflow eventually.
Free access to some good premium tools/data.
Listening to that hunger inside me to want to know how to do it, when I saw others doing it years ago.
