R. Rabbit

A new version of #Anket is available at github.com/redrabytes/ank…. I've entirely recoded it in #Python3, the code is much more powerful than the previous version, it may present some bugs/optimization issues, don't hesitate to let me know or submit pull requests on the repo. Enjoy!

🔷An investigations on @Dyjix, the shadiest french host: ➡️On the surface, it’s just another “serious” hosting provider. Clean branding, professional image, standard corporate talk. But once you start connecting the dots, the picture changes fast. 🔎For context, Axel Hauguel, the person behind @Dyjix, is not new to this space. He previously operated infrastructure like AS Constant Moulin (AS203168) that @banthisguy9349 reported for month. This AS was repeatedly associated with abusive hosting (malware, botnets, DDoS tooling, etc). That alone already raises questions. But the current situation goes further. 📊Over the past months, France has been hit by a wave of cyberattacks, leading to massive leaks of personal data from various services (telecoms, administrative platforms, etc). From this ecosystem, a new type of tool emerged: “searchers”. 💻A searcher is basically a database aggregation system built on stolen data dumps. You input something as simple as: – full name – phone number – email address And it returns highly sensitive personal information: – home addresses – identity-related data – linked accounts – sometimes family or behavioral traces depending on the leaks 🎯In practice, it’s industrialized doxxing. And it’s not theoretical use. ➡️These tools are widely used to target real people: teachers, journalists, public figures, streamers, and sometimes completely unrelated private individuals. Harassment, intimidation, and privacy violations are a direct consequence, In some cases, these types of tools lead to burglaries like with the @tir_ff databreach. ⚠One of the most known examples is AstralSearcher. After losing its original domain due to takedown actions by the @Interieur_Gouv / @CNIL, it didn’t disappear. It moved. ➡️And according to multiple infrastructure traces and historical data (including @censysio observations), parts of its operation appear to have resurfaced under infrastructure linked to @Dyjix. *To be honest, ive kinda wasted time with this investigations since the owner leak it on the /legal/ page* 🔁At that point, the “we don’t know what’s hosted on our servers” narrative becomes hard to defend. Especially when the same ecosystem keeps appearing around malware infrastructure, abusive tooling, and now services built directly on stolen personal data. 🧩This is where the pattern becomes hard to ignore. Same names. Same infrastructure circles. Same type of services. At some point, it stops looking like coincidence and starts looking like a business model. 🧠Dyjix may present itself as a neutral hosting provider. But the reality, based on repeated associations, looks a lot closer to a facade enabling high-abuse infrastructure. 📌In that tweet, I mentioned only 25% of what I know about this host, and believe me, that's just the tip of the iceberg. If there were a police investigation, I would be happy to share what I've been able to gather. 💬If @Dyjix, @Hexicans, or @Landry__J want to respond, please do so :) 👋cc/@abuse_ch @banthisguy9349 @redrabytes @swezy_1337 @CNIL

@l4663r666h05t not at all, just a little misconfiguration of the webserver.

@redrabytes new cve?

Whoops 🧐

I'm not such a bad guy 😇 youtube.com/watch?v=RgDzZg… 🪽

api[.]jwala[.]applla[.]com – jwala[.]applla[.]com

www[.]aws-recovery[.]net recovery-assessment[.]com eu-west-3[.]console[.]aws[.]recovery-assessment[.]com eu-north-1[.]console[.]aws[.]recovery-assessment[.]com us-west-2[.]console[.]aws[.]recovery-assessment[.]com me-south-1[.]console[.]aws[.]recovery-assessment[.]com sa-east-1[.]console[.]aws[.]recovery-assessment[.]com eu-south-1[.]console[.]aws[.]recovery-assessment[.]com eu-west-1[.]console[.]aws[.]recovery-assessment[.]com eu-west-2[.]console[.]aws[.]recovery-assessment[.]com ap-southeast-1[.]console[.]aws[.]recovery-assessment[.]com eu-central-1[.]console[.]aws[.]recovery-assessment[.]com ap-northeast-1[.]console[.]aws[.]recovery-assessment[.]com console[.]recovery-assessment[.]com cdn[.]console[.]recovery-assessment[.]com b[.]cdn[.]console[.]recovery-assessment[.]com ca-central-1[.]console[.]aws[.]recovery-assessment[.]com ap-southeast-2[.]console[.]aws[.]recovery-assessment[.]com ap-northeast-3[.]console[.]aws[.]recovery-assessment[.]com ap-northeast-2[.]console[.]aws[.]recovery-assessment[.]com a[.]b[.]cdn[.]console[.]recovery-assessment[.]com ap-south-1[.]console[.]aws[.]recovery-assessment[.]com us-west-1[.]console[.]aws[.]recovery-assessment[.]com af-south-1[.]console[.]aws[.]recovery-assessment[.]com ap-east-1[.]console[.]aws[.]recovery-assessment[.]com us-east-1[.]console[.]aws[.]recovery-assessment[.]com console[.]aws[.]recovery-assessment[.]com aws[.]recovery-assessment[.]com us-east-2[.]console[.]aws[.]recovery-assessment[.]com phd[.]aws[.]recovery-assessment[.]com signin[.]aws[.]recovery-assessment[.]com www[.]signin[.]aws[.]aws-recovery[.]net console[.]aws[.]aws-recovery[.]net iq[.]aws[.]aws-recovery[.]net aws-recovery[.]net phd[.]aws[.]aws-recovery[.]net us-east-1[.]console[.]aws[.]aws-recovery[.]net ap-east-1[.]console[.]aws[.]aws-recovery[.]net signin[.]aws[.]aws-recovery[.]net us-east-2[.]console[.]aws[.]aws-recovery[.]net ca-central-1[.]console[.]aws[.]aws-recovery[.]net eu-central-1[.]console[.]aws[.]aws-recovery[.]net console[.]aws-recovery[.]net cdn[.]console[.]aws-recovery[.]net b[.]cdn[.]console[.]aws-recovery[.]net eu-west-3[.]console[.]aws[.]aws-recovery[.]net af-south-1[.]console[.]aws[.]aws-recovery[.]net a[.]b[.]cdn[.]console[.]aws-recovery[.]net me-south-1[.]console[.]aws[.]aws-recovery[.]net ap-northeast-1[.]console[.]aws[.]aws-recovery[.]net ap-southeast-1[.]console[.]aws[.]aws-recovery[.]net us-west-1[.]console[.]aws[.]aws-recovery[.]net eu-north-1[.]console[.]aws[.]aws-recovery[.]net eu-west-1[.]console[.]aws[.]aws-recovery[.]net eu-south-1[.]console[.]aws[.]aws-recovery[.]net ap-northeast-3[.]console[.]aws[.]aws-recovery[.]net sa-east-1[.]console[.]aws[.]aws-recovery[.]net ap-southeast-2[.]console[.]aws[.]aws-recovery[.]net us-west-2[.]console[.]aws[.]aws-recovery[.]net ap-south-1[.]console[.]aws[.]aws-recovery[.]net eu-west-2[.]console[.]aws[.]aws-recovery[.]net ap-northeast-2[.]console[.]aws[.]aws-recovery[.]net 158[.]94[.]208[.]122 AS214943 Railnet LLC 🇩🇪

Domain conn(.)elbbird(.)zip C2 178(.)16(.)54(.)252:443 cc @500mk500 @banthisguy9349

New infrastructure of #Masjesu Botnet discovered Spreader 87(.)120(.)191(.)13 (🇳🇱 AS215925 VPSVAULT.HOST LTD) IP 178(.)16(.)54(.)252 (🇳🇱 AS209800 metaspinner net GmbH) Downloader 1 hxxp://178(.)16(.)54(.)252/bins(.)sh Downloader 2 hxxp://178(.)16(.)54(.)252/(.)shell

#Malware: DDOS:Linux/#Mirai IP 82(.)27(.)2(.)83 Downloader hxxp://82(.)27(.)2(.)83/knet(.)sh FTP ftp://ftp:82(.)27(.)2(.)83:ftp/knet1(.)sh C2 82(.)27(.)2(.)83:1312 SQL server 82(.)27(.)2(.)83:3306 cc @500mk500

#Malware: DDOS:Linux/#Mirai IP 176(.)65(.)149(.)225 (🇩🇪 AS51396 @Pfcloudio UG) Downloader hxxp://176(.)65(.)149(.)225/x86_64 C2 94(.)156(.)152(.)65:61459 (🇿🇦 AS214209 Internet Magnate (Pty) Ltd) DNS rockwood(.)call105(.)net, host117(.)xtpanel(.)org, autodiscover(.)milkir(.)ro

#Malware: DDOS:Linux/#Mirai IP 109(.)205(.)213(.)5 (🇺🇸 AS19318 @Interserver, Inc) Downloader hxxp://109(.)205(.)213(.)5/sh C2 192(.)227(.)134(.)76:3211 (AS36352 @HostPapa) Listener 192(.)227(.)134(.)76:1412 API endpoint 192(.)227(.)134(.)76:10257