Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 25-May-2026 22:41:00 JST Kevin Beaumont

   RE: https://infosec.exchange/@briankrebs/116635448484355293

   After years of monitoring these “companies” networks I saw 100% malicious traffic (Stark Industries and the like). They literally had no legit customers.

   Running out of UK limited companies too, there appears to be very little checks and balances in the UK to see if a company even has people in the UK.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 25-May-2026 22:44:10 JST Kevin Beaumont

     in reply to

     There was a time NoName were operating from Stark Industries for a prolonged person, attacking the UK. The NCSC didn’t really know what to do so I ended up evicting them by getting them nullrouted by ISP for spam. https://cyberplace.social/@GossiTheDog/111788974637289906

   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Monday, 25-May-2026 22:48:00 JST BrianKrebs

     in reply to

     @GossiTheDog Right. Meanwhile, the guy running it just continues to tell the media with a straight face that they never really got any abuse complaints. My response to that is yea that's what happens when your abuse mailbox goes straight to /dev/null/.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 25-May-2026 22:48:00 JST Kevin Beaumont

     in reply to

     • BrianKrebs

     @briankrebs you’ll be surprised to know this got no reply or action 🙀 although somebody did submit a complaint to GitHub about doxxing on that repo link, causing GitHub to remove it. It contained no PII or doxxing, just the botnet config.