NameSilo

⚠️ Suspicious "Secure Document Ready" page The page claims a PDF viewer update is required and attempts to download a ScreenConnect client from an external host. IOCs: Domain: - fussions[.]top - brookingsagent[.]screenconnect[.]com Download URL: hxxps://brookingsagent[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=doctorate File name: ScreenConnect.ClientSetup.exe File hash: a1912b1fc666df5a13c6e84d9dc6751ece238495d77b6a13d4def0b5b40e07e2 #phishing #ScreenConnect #RemoteAccess @500mk500 @skocherhan @patialavii

🔷An investigations on @Dyjix, the shadiest french host: ➡️On the surface, it’s just another “serious” hosting provider. Clean branding, professional image, standard corporate talk. But once you start connecting the dots, the picture changes fast. 🔎For context, Axel Hauguel, the person behind @Dyjix, is not new to this space. He previously operated infrastructure like AS Constant Moulin (AS203168) that @banthisguy9349 reported for month. This AS was repeatedly associated with abusive hosting (malware, botnets, DDoS tooling, etc). That alone already raises questions. But the current situation goes further. 📊Over the past months, France has been hit by a wave of cyberattacks, leading to massive leaks of personal data from various services (telecoms, administrative platforms, etc). From this ecosystem, a new type of tool emerged: “searchers”. 💻A searcher is basically a database aggregation system built on stolen data dumps. You input something as simple as: – full name – phone number – email address And it returns highly sensitive personal information: – home addresses – identity-related data – linked accounts – sometimes family or behavioral traces depending on the leaks 🎯In practice, it’s industrialized doxxing. And it’s not theoretical use. ➡️These tools are widely used to target real people: teachers, journalists, public figures, streamers, and sometimes completely unrelated private individuals. Harassment, intimidation, and privacy violations are a direct consequence, In some cases, these types of tools lead to burglaries like with the @tir_ff databreach. ⚠One of the most known examples is AstralSearcher. After losing its original domain due to takedown actions by the @Interieur_Gouv / @CNIL, it didn’t disappear. It moved. ➡️And according to multiple infrastructure traces and historical data (including @censysio observations), parts of its operation appear to have resurfaced under infrastructure linked to @Dyjix. *To be honest, ive kinda wasted time with this investigations since the owner leak it on the /legal/ page* 🔁At that point, the “we don’t know what’s hosted on our servers” narrative becomes hard to defend. Especially when the same ecosystem keeps appearing around malware infrastructure, abusive tooling, and now services built directly on stolen personal data. 🧩This is where the pattern becomes hard to ignore. Same names. Same infrastructure circles. Same type of services. At some point, it stops looking like coincidence and starts looking like a business model. 🧠Dyjix may present itself as a neutral hosting provider. But the reality, based on repeated associations, looks a lot closer to a facade enabling high-abuse infrastructure. 📌In that tweet, I mentioned only 25% of what I know about this host, and believe me, that's just the tip of the iceberg. If there were a police investigation, I would be happy to share what I've been able to gather. 💬If @Dyjix, @Hexicans, or @Landry__J want to respond, please do so :) 👋cc/@abuse_ch @banthisguy9349 @redrabytes @swezy_1337 @CNIL