Heritage AS32403 Major BGP spike yesterday

hash negative 657993921 MongoDB pivot from SheepMC Recording #52

MongoDB Global China-Russia network November 2024 - present

Summary Recording #43

last-effort-sept-9

Prisma

Users-dates-missing-stripe-billing-field-Recording #31

users dates no stripe billing field 2

183 admin accounts created between Feb 18, 2025 and Feb 28, 2025 (need to go get count for JUST 2/18)

Packetware

admin service project api keys testing proxmoxvm edward oauth

project service uptick around jan 2025

ip address rotation linking projects and failed provisions

Recording #23

Recording #22

admins and other things

Users-Admin-Hypervisor-Recording #20

Packetware has no customers

packetware left their customer database online with no password, proving they are a shell company with less than 10 paying customers.

Packetware ProxMox VM lots spun up and terminated Jan 14, 2025 - Feb 11, 2025

Packetware Discord roughly 70 members, only a fraction are paying customers

Created: Sep 6, 2025

Packetware Discord channel recording as of September 5, 2025

LONG New Dallas VMs 8/2/25, HypervisorNode, Admin 2/18/25 fast, Users fast (Recording #20)

Prisma Edward C users and Firewall Rules(Recording #21)

Prisma Anonymous Sessions early-late 2024 (Recording #23)

Firewall, Virtual Machines, Coristine accounts, nearly 200 admin accounts created 2/18/2025, possible container IDs, IP addresses (Recording #24)

Test Project 2 is important, Shows IP rotation and VM deletion (Recording #25)

Test Project 2 has 154 services, 2 API keys, 1 SSH key, 33 ProxMoxVMs,, (Recording #25) 7:43 nice view of all canceled VMs and IPs 7:58 shows lots of troubleshooting on 1/26/2025 and "vpn-tutorial" shows IP address rotation of the German SSH 63.x.x.x/24 range pattern is 3, 5, 7, 9 1 or 2 minutes apart, lives for 2 days before deletion 9:15 shows fresh installs of Ubuntu 7/3/2025 and api (VM)creation and deletion one day later...is the service id for this found in prometheus? 9:20 IPv4 Subnet 9:35 IPv4 Addresses showing gateway, MAC, the 2 main projectIDs have the only assigned IPs 9:48 shows VM names implying infra, there's a Chinese name VM yuqi end of video shows users and emails but there's better vids of this

Packetware Users, Email, 2/20/25 Coristine creates account followed by f.gov user hours later same day (Recording #31)

Packetware Users, Email, 2/20/25 Coristine creates account followed by f.gov user hours later same day (Recording #31) Note Russian, Chinese names

Packetware Prisma customers no billing details

Packetware Prisma possible container IDs "Services"

Packetware Prisma ProxMoxVM dates align with DOGE access to OPM, Treasury

Packetware IP addresses for Virtual Machines, including vpp tunnel, address, host

Packetware Prisma Project showing links to admin accounts made on Feb 18, 2025. Includes activity from Feb 8, 2025 one day after my analysis of Prometheus

Packetware Prisma API and SSH keys admin

Packetware Prisma doing something on 2/8/2025 around 3 pm and deleted immediately after

Packetware Evidence