Heritage AS32403 Major BGP spike yesterday

00:56

hash negative 657993921 MongoDB pivot from SheepMC Recording #52

00:29

MongoDB Global China-Russia network November 2024 - present

03:21

MongoDB Global China-Russia network November 2024 - present

03:34

Summary Recording #43

06:13

last-effort-sept-9

01:35

Prisma

07:34

Users-dates-missing-stripe-billing-field-Recording #31

04:03

users dates no stripe billing field 2

02:11

183 admin accounts created between Feb 18, 2025 and Feb 28, 2025 (need to go get count for JUST 2/18)

00:47

Packetware

1:52:12

admin service project api keys testing proxmoxvm edward oauth

13:09

project service uptick around jan 2025

11:19

ip address rotation linking projects and failed provisions

11:53

Recording #23

02:16

Recording #22

12:03

admins and other things

05:41

Users-Admin-Hypervisor-Recording #20

21:20

Packetware has no customers

17:03

packetware left their customer database online with no password, proving they are a shell company with less than 10 paying customers.

Packetware ProxMox VM lots spun up and terminated Jan 14, 2025 - Feb 11, 2025

03:16

Packetware Discord roughly 70 members, only a fraction are paying customers

Sep 6, 2025 | 17:25

Packetware Discord channel recording as of September 5, 2025

LONG New Dallas VMs 8/2/25, HypervisorNode, Admin 2/18/25 fast, Users fast (Recording #20)

21:20

Prisma Edward C users and Firewall Rules(Recording #21)

05:41

Prisma Anonymous Sessions early-late 2024 (Recording #23)

02:16

Firewall, Virtual Machines, Coristine accounts, nearly 200 admin accounts created 2/18/2025, possible container IDs, IP addresses (Recording #24)

11:53

Test Project 2 is important, Shows IP rotation and VM deletion (Recording #25)

11:19

Test Project 2 has 154 services, 2 API keys, 1 SSH key, 33 ProxMoxVMs,, (Recording #25) 7:43 nice view of all canceled VMs and IPs 7:58 shows lots of troubleshooting on 1/26/2025 and "vpn-tutorial" shows IP address rotation of the German SSH 63.x.x.x/24 range pattern is 3, 5, 7, 9 1 or 2 minutes apart, lives for 2 days before deletion 9:15 shows fresh installs of Ubuntu 7/3/2025 and api (VM)creation and deletion one day later...is the service id for this found in prometheus? 9:20 IPv4 Subnet 9:35 IPv4 Addresses showing gateway, MAC, the 2 main projectIDs have the only assigned IPs 9:48 shows VM names implying infra, there's a Chinese name VM yuqi end of video shows users and emails but there's better vids of this

Packetware Users, Email, 2/20/25 Coristine creates account followed by f.gov user hours later same day (Recording #31)

04:03

Packetware Users, Email, 2/20/25 Coristine creates account followed by f.gov user hours later same day (Recording #31) Note Russian, Chinese names

Packetware Prisma customers no billing details

03:44

Packetware Prisma possible container IDs "Services"

00:41

Packetware Prisma ProxMoxVM dates align with DOGE access to OPM, Treasury

01:21

Packetware IP addresses for Virtual Machines, including vpp tunnel, address, host

01:11

Packetware Prisma Project showing links to admin accounts made on Feb 18, 2025. Includes activity from Feb 8, 2025 one day after my analysis of Prometheus

02:19

Packetware Prisma API and SSH keys admin

01:20

Packetware Prisma doing something on 2/8/2025 around 3 pm and deleted immediately after

00:37