As regards the DDOS of Ubuntu, preliminary look seems to indicate beamed[.]su & beamed[.]st → beamed[.]cc → bulletproof registrar immateriali[.]sm (IANA 50012) and Romanian ISP Materialism S.r.l. (AS39287).
-
As regards the DDOS of Ubuntu, preliminary look seems to indicate beamed[.]su & beamed[.]st → beamed[.]cc → bulletproof registrar immateriali[.]sm (IANA 50012) and Romanian ISP Materialism S.r.l. (AS39287). They offer domain registration at a flat rate and via JSON API, which are both correlated with high abuse patterns. The registration paperwork for the Immaterialism Limited UK business filing shows signs familiar to me that indicate possible fraudulent filing, using only Registered Business Agents and their addresses, and an unusually quick churn in Officers or Persons of Significant Control.
Historical BGP data shows Immaterialism's AS number was transferred from previous ASN 'ab stract ltd' connected to abstract[.]fi, and all ab stract's IP prefixes went to Materialism S.r.l. in what appear to be a coordinated handoff in late February 2026. "Immaterialism" also appears to be a recycled AS name, so technical indicators point to "ASN-washing" in order to obscure route announcement origins or other factors.
Unsurprisingly, Cloudflare protects the two primary Beamed domains involved. It seems the DDOS was called off once Ubuntu signed on as a customer with... Cloudflare.
Further investigations of all parties mentioned above is highly encouraged.
-
As regards the DDOS of Ubuntu, preliminary look seems to indicate beamed[.]su & beamed[.]st → beamed[.]cc → bulletproof registrar immateriali[.]sm (IANA 50012) and Romanian ISP Materialism S.r.l. (AS39287). They offer domain registration at a flat rate and via JSON API, which are both correlated with high abuse patterns. The registration paperwork for the Immaterialism Limited UK business filing shows signs familiar to me that indicate possible fraudulent filing, using only Registered Business Agents and their addresses, and an unusually quick churn in Officers or Persons of Significant Control.
Historical BGP data shows Immaterialism's AS number was transferred from previous ASN 'ab stract ltd' connected to abstract[.]fi, and all ab stract's IP prefixes went to Materialism S.r.l. in what appear to be a coordinated handoff in late February 2026. "Immaterialism" also appears to be a recycled AS name, so technical indicators point to "ASN-washing" in order to obscure route announcement origins or other factors.
Unsurprisingly, Cloudflare protects the two primary Beamed domains involved. It seems the DDOS was called off once Ubuntu signed on as a customer with... Cloudflare.
Further investigations of all parties mentioned above is highly encouraged.
No surprise Canonical signed up.
-
R relay@relay.mycrowd.ca shared this topic
