Yesterday, Bullet Proof Hosting provider sclad{.}us aka Morningstars (AS215939) connected to UAC-0050 (CERT-UA#8453 and CERT-UA#8494 Alerts) announced "technical works" as their main upstream drop them.
March 20, 2025 at 12:57 PM
Yesterday, Bullet Proof Hosting provider sclad{.}us aka Morningstars (AS215939) connected to UAC-0050 (CERT-UA#8453 and CERT-UA#8494 Alerts) announced "technical works" as their main upstream drop them.
One month after the release of our Doppelganger investigation and the shutdown of Aeza at Datacamp, the ASNs that made it to the finish line have migrated to @packetbouncer @aurologiccom and @RoyaleHostingBV @stanvandeklippe
Many prefixes remain behind GRE tunnels.
Many prefixes remain behind GRE tunnels.
March 20, 2025 at 12:56 PM
One month after the release of our Doppelganger investigation and the shutdown of Aeza at Datacamp, the ASNs that made it to the finish line have migrated to @packetbouncer @aurologiccom and @RoyaleHostingBV @stanvandeklippe
Many prefixes remain behind GRE tunnels.
Many prefixes remain behind GRE tunnels.
The power of CSI (194.36.177{.}229) server of 1cent{.}host runs in AS210281. Can you figure out where do the GRE tunnels of this BPH terminate? @banthisguy9349
March 20, 2025 at 12:56 PM
The power of CSI (194.36.177{.}229) server of 1cent{.}host runs in AS210281. Can you figure out where do the GRE tunnels of this BPH terminate? @banthisguy9349
MTU1448 update: Doppelganger Prefix sneaking away from Aurologic upstream to AS214891. Prefix now using AS56630 Melbikomas (LT) as upstream in Germany. route: 77.91.66.0/24
origin: AS214891
mnt-by: CENTHOST-MNT
last-modified: 2024-08-02T09:47:27Z
origin: AS214891
mnt-by: CENTHOST-MNT
last-modified: 2024-08-02T09:47:27Z
March 20, 2025 at 12:56 PM
MTU1448 update: Doppelganger Prefix sneaking away from Aurologic upstream to AS214891. Prefix now using AS56630 Melbikomas (LT) as upstream in Germany. route: 77.91.66.0/24
origin: AS214891
mnt-by: CENTHOST-MNT
last-modified: 2024-08-02T09:47:27Z
origin: AS214891
mnt-by: CENTHOST-MNT
last-modified: 2024-08-02T09:47:27Z
The answer is 1448. In a standard setup the maximum payload for a ICMP packet will be 1472 bytes (1500-20-8). 28 bytes for the IP (20) and ICMP (8) headers.
If you run GRE tunnels, you need to account for a 24 extra bytes overhead for Outer IP(20) and GRE(4).
1500-20-8-20-4=1448
If you run GRE tunnels, you need to account for a 24 extra bytes overhead for Outer IP(20) and GRE(4).
1500-20-8-20-4=1448
March 20, 2025 at 12:56 PM
The answer is 1448. In a standard setup the maximum payload for a ICMP packet will be 1472 bytes (1500-20-8). 28 bytes for the IP (20) and ICMP (8) headers.
If you run GRE tunnels, you need to account for a 24 extra bytes overhead for Outer IP(20) and GRE(4).
1500-20-8-20-4=1448
If you run GRE tunnels, you need to account for a 24 extra bytes overhead for Outer IP(20) and GRE(4).
1500-20-8-20-4=1448
Yesterday, AS198981 (netshield/1centhost) continued to serve Doppelganger domains but this time with @packetbouncer (Aurologic) as upstreams. This is not the kind of blocking we were expecting from you.
March 20, 2025 at 12:56 PM
Yesterday, AS198981 (netshield/1centhost) continued to serve Doppelganger domains but this time with @packetbouncer (Aurologic) as upstreams. This is not the kind of blocking we were expecting from you.
This is why we think that Lethost bullet proof hosting that run DG is NOT just a costumer of Aeza (1/x)
March 20, 2025 at 12:56 PM
This is why we think that Lethost bullet proof hosting that run DG is NOT just a costumer of Aeza (1/x)
Suspended Cyberhub ASN that is part of the Doppelganger ecosystem has been just renamed to HellaAS (Hellenic Digital Services Ltd / Luxhost). Seems like "luxhost" is the new Aeza bullet proof hoster. 🤦
@Gi7w0rm @banthisguy9349 @SourcesOuvertes
@Gi7w0rm @banthisguy9349 @SourcesOuvertes
March 20, 2025 at 12:56 PM
Suspended Cyberhub ASN that is part of the Doppelganger ecosystem has been just renamed to HellaAS (Hellenic Digital Services Ltd / Luxhost). Seems like "luxhost" is the new Aeza bullet proof hoster. 🤦
@Gi7w0rm @banthisguy9349 @SourcesOuvertes
@Gi7w0rm @banthisguy9349 @SourcesOuvertes
In a new twist in the saga of Doppelganger, Aeza has decided to stop providing connectivity to two bullet proof hosters: Lethost and Sunhost. What a nice way to show the world that they handle "abuse". (1/3)
March 20, 2025 at 12:56 PM
In a new twist in the saga of Doppelganger, Aeza has decided to stop providing connectivity to two bullet proof hosters: Lethost and Sunhost. What a nice way to show the world that they handle "abuse". (1/3)
Since the release of our forensic investigation about Doppelganger infrastructure there has been a few interesting developments. Once of them is that the F-domains @ TNSECURITY and NETSHIELD remain online thanks to one common upstream provider: Datacamp/CDN77
March 20, 2025 at 12:56 PM
Since the release of our forensic investigation about Doppelganger infrastructure there has been a few interesting developments. Once of them is that the F-domains @ TNSECURITY and NETSHIELD remain online thanks to one common upstream provider: Datacamp/CDN77
It seems that TNSECURITY/EVILEMPIRE is no longer routing traffic from Germany. Nice to have now a much clear picture of where Lethost is coming from
March 20, 2025 at 12:56 PM
It seems that TNSECURITY/EVILEMPIRE is no longer routing traffic from Germany. Nice to have now a much clear picture of where Lethost is coming from
Hostinger today, DNS parking the F domains of DG. bikerspace[.]shop
btwidea[.]shop
cscerbr[.]shop
envhb[.]shop
summitslope[.]shop
vokei[.]shop
btwidea[.]shop
cscerbr[.]shop
envhb[.]shop
summitslope[.]shop
vokei[.]shop
March 20, 2025 at 12:56 PM
Hostinger today, DNS parking the F domains of DG. bikerspace[.]shop
btwidea[.]shop
cscerbr[.]shop
envhb[.]shop
summitslope[.]shop
vokei[.]shop
btwidea[.]shop
cscerbr[.]shop
envhb[.]shop
summitslope[.]shop
vokei[.]shop
TNSecurity (aka Evilempire) is interesting for 4 things:
- Runs from Germany as downstream of @packetbouncer - Runs front proxies for Doppelganger
- It is a hotspot of malware distribution
- It was a "dorector"
@Gi7w0rm @ffforward @banthisguy9349
- Runs from Germany as downstream of @packetbouncer - Runs front proxies for Doppelganger
- It is a hotspot of malware distribution
- It was a "dorector"
@Gi7w0rm @ffforward @banthisguy9349
March 20, 2025 at 12:56 PM
TNSecurity (aka Evilempire) is interesting for 4 things:
- Runs from Germany as downstream of @packetbouncer - Runs front proxies for Doppelganger
- It is a hotspot of malware distribution
- It was a "dorector"
@Gi7w0rm @ffforward @banthisguy9349
- Runs from Germany as downstream of @packetbouncer - Runs front proxies for Doppelganger
- It is a hotspot of malware distribution
- It was a "dorector"
@Gi7w0rm @ffforward @banthisguy9349
Let us check of few domains of DG campaign today that were registered with Namecheap and then moved to Hostinger DNS parking service. The service has been provided for months and tje domains have been pointed to:
AS215428 Mykyta Skorobohatko RU
AS216309 Tnsecurity Ltd RU
AS215428 Mykyta Skorobohatko RU
AS216309 Tnsecurity Ltd RU
March 20, 2025 at 12:55 PM
Let us check of few domains of DG campaign today that were registered with Namecheap and then moved to Hostinger DNS parking service. The service has been provided for months and tje domains have been pointed to:
AS215428 Mykyta Skorobohatko RU
AS216309 Tnsecurity Ltd RU
AS215428 Mykyta Skorobohatko RU
AS216309 Tnsecurity Ltd RU
Just a couple of hours ago, all these domains has been used by Doppelganger. All controlled from:
- Hostinger DNS Parking service and - Served from "Evilempire" downstream of Aurologic in Germany.
- Hostinger DNS Parking service and - Served from "Evilempire" downstream of Aurologic in Germany.
March 20, 2025 at 12:55 PM
Just a couple of hours ago, all these domains has been used by Doppelganger. All controlled from:
- Hostinger DNS Parking service and - Served from "Evilempire" downstream of Aurologic in Germany.
- Hostinger DNS Parking service and - Served from "Evilempire" downstream of Aurologic in Germany.
Today, we make public our latest research on Doppelganger. https://www.qurium.org/alerts/russia/exposing-the-evil-empire-of-doppelganger-disinformation/
March 20, 2025 at 12:55 PM
Today, we make public our latest research on Doppelganger. https://www.qurium.org/alerts/russia/exposing-the-evil-empire-of-doppelganger-disinformation/
“We have a well-established process for identifying and mitigating risks on our platforms,” said Meta. “We look forward to continuing our co-operation with the European Commission and providing them with further details of this work.”
March 20, 2025 at 12:55 PM
“We have a well-established process for identifying and mitigating risks on our platforms,” said Meta. “We look forward to continuing our co-operation with the European Commission and providing them with further details of this work.”
We are trying to reach out @PlainProxies regarding the use of their IPv6 proxies to conduct denial of service attacks.
March 20, 2025 at 12:55 PM
We are trying to reach out @PlainProxies regarding the use of their IPv6 proxies to conduct denial of service attacks.
Does anyone know why crypto-scams dashboards are no threats? Ping us if you want the list and can do something about it.
March 20, 2025 at 12:55 PM
Does anyone know why crypto-scams dashboards are no threats? Ping us if you want the list and can do something about it.
It just took 1254 days. Thanks to those that report it @jsrailton @RonDeibert @accessnow @PeterGuest https://www.qurium.org/alerts/egypt/how-operators-use-sandvine-to-block-independent-media-in-egypt/ https://x.com/PeterGuest/status/1762457911446401462
March 20, 2025 at 12:54 PM
It just took 1254 days. Thanks to those that report it @jsrailton @RonDeibert @accessnow @PeterGuest https://www.qurium.org/alerts/egypt/how-operators-use-sandvine-to-block-independent-media-in-egypt/ https://x.com/PeterGuest/status/1762457911446401462
Imagine a world when you can operate million of IPv6 addresses that have bogus geolocations and you can be anywhere. https://www.qurium.org/press-releases/ddos-attacks-against-hungarian-media-traced-to-yet-another-proxy-provider/
March 20, 2025 at 12:54 PM
Imagine a world when you can operate million of IPv6 addresses that have bogus geolocations and you can be anywhere. https://www.qurium.org/press-releases/ddos-attacks-against-hungarian-media-traced-to-yet-another-proxy-provider/
8000+ addresses leased by @IPXOcom to Aliat Data. Is this "Know your Custumer? "Advanced KYC checks"
March 20, 2025 at 12:54 PM
8000+ addresses leased by @IPXOcom to Aliat Data. Is this "Know your Custumer? "Advanced KYC checks"