8.219.201.100 | Alibaba Cloud (Singapore) Private Limited | AbuseIPDB seen using treasury cert on 2/7/25 new, ssh knocking and brute force
All U.S. Intelligence Likely Compromised by DOGE
8.219.214.1 | Alibaba Cloud (Singapore) Private Limited | AbuseIPDB new treasury cert china alibaba ip
observed 2025-02-07 06:00:13.411222+00:00 w treasury cert 68exxxx
VirusTotal - IP address - 8.219.201.100 more ali baba findings
Wed February 5. Trump energy secretary allowed 23-year-old DOGE rep to access IT systems over objections from general counsel | CNN
On Friday, DOE leadership installed a different SpaceX engineer as chief information officer — the department’s top IT official.
Luke Farritor
Jomanw - Repositories browserless is here, forked from main jordan wick
Jomanw has 27 repositories available. Follow their code on GitHub.
Edward Big Balls Github and associatesbrowserless/browserless: Deploy headless browsers in Docker. Run on our cloud or bring your own. Free for non-commercial uses.
cant find jordans version but he prob forked from main
Jomanw’s gists Jordan Wick github gists as of feb 28, 2025, same day the thread was published about his github activity re: employee lists, marine cables, etc important because implies DOGE was beginning to work before the transition (mineral deposits and undersea cables posted around jan 3 - 5)
https://threadreaderapp.com/thread/1895609294810464390.html
came out same day as this capture
Jomanw’s gists Feb 7, 2025 jordan wick
GitHub Gist: star and fork Jomanw's gists by creating an account on GitHub.
Thread by @SollenbergerRC on Thread Reader App jordan wick github archive check
@SollenbergerRC: NEW: A DOGE staffer appears to be posting DOGE work on his public GitHub, as of this week. The staffer, Jordan Wick, also created a repository for a Twitter DM-downloading tool just 3 days ago....…
Wayback Machine https://github.com/Jomanw/browserless is what i need to find an archive of
Jomanw - Repositories jordan wick nlrb among others
Jomanw has 27 repositories available. Follow their code on GitHub.
LDAP OID Reference
https://www.shodan.io/host/166.123.218.80 highlighted
keeps skipping response
1.3.6.1.4.1.30221.1.5.2
Replication Repair Request Control
UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.11 Administrative Operation Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.11
1.3.6.1.4.1.30221.2.5.12 Extended Schema Info Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.14 Get Server ID Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.16 Route to Server Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.17 Exclude Branch Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.19 Operation Purpose Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.20 Soft Delete Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.22 Hard Delete Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.23 Undelete Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.24 Soft-Deleted Entry Access Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.25 Get User Resource Limits Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.27 Suppress Operational Attribute Update Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.28 Assured Replication Request Control UnboundID Directory Server
1.3.6.1.4.1.30221.2.5.31 Retire Password Request Control UnboundID Directory Server
Jan - March 2025 investigative leads, evidence of privacy risks violations
UnboundID LDAP SDK for Java treasury related important
The UnboundID LDAP SDK for Java is a fast, powerful, user-friendly, and completely free Java library for communicating with LDAP directory servers. It offers better performance, better ease of use,…
The LDAP SDK also includes APIs for developing support for any custom protocol extensions that you may need but aren’t included as part of the LDAP SDK.
Built-in support for a wide range of official and de facto standard protocol extensions, including controls, extended operations, and SASL mechanisms. The LDAP SDK also includes APIs for developing support for any custom protocol extensions that you may need but aren’t included as part of the LDAP SDK.
Prominent DOGE Staffer Is Grandson Of Turncoat KGB Spy
Edward “Big Balls” Coristine happens to be the descendant of Valery Martynov, a KGB agent who spied for the US.
IP Map Report - IPinfo.io Non-treasury oracle and ali baba that had cert fingerprint 68xxxx this past year, starting around december 2024
We're the trusted source for IP address information, handling 50 billion IP geolocation API requests per month for over 1,000 businesses and 100,000+ developers
Search (from:datarepublican to:elonmusk) even more recent tweets from datarepublican to elon musk
DatarepublicanHistory#5060 tigta treasury voip
2025_0414_Berulis-Disclosure-Supplemental-with-Exhibit.pdf
Jan 2025 start of investigation OPM emails articleHistory: 164.95.88.80 treasury ldap
Search Engine for the Internet of Things
LDAP:
SupportedLDAPVersion:
2
3
SupportedControl:
1.2.826.0.1.3344810.2.3
1.2.840.113556.1.4.1413
1.2.840.113556.1.4.319
1.2.840.113556.1.4.473
1.2.840.113556.1.4.805
1.3.6.1.1.12
1.3.6.1.1.13.1
1.3.6.1.1.13.2
1.3.6.1.1.21.2
1.3.6.1.4.1.30221.1.5.2
1.3.6.1.4.1.30221.2.5.1
1.3.6.1.4.1.30221.2.5.11
1.3.6.1.4.1.30221.2.5.12
1.3.6.1.4.1.30221.2.5.14
1.3.6.1.4.1.30221.2.5.16
1.3.6.1.4.1.30221.2.5.17
1.3.6.1.4.1.30221.2.5.19
1.3.6.1.4.1.30221.2.5.2
1.3.6.1.4.1.30221.2.5.20
1.3.6.1.4.1.30221.2.5.22
1.3.6.1.4.1.30221.2.5.23
1.3.6.1.4.1.30221.2.5.24
1.3.6.1.4.1.30221.2.5.25
1.3.6.1.4.1.30221.2.5.27
1.3.6.1.4.1.30221.2.5.28
1.3.6.1.4.1.30221.2.5.3
1.3.6.1.4.1.30221.2.5.31
1.3.6.1.4.1.30221.2.5.32
1.3.6.1.4.1.30221.2.5.36
1.3.6.1.4.1.30221.2.5.38
1.3.6.1.4.1.30221.2.5.4
1.3.6.1.4.1.30221.2.5.40
1.3.6.1.4.1.30221.2.5.42
1.3.6.1.4.1.30221.2.5.44
1.3.6.1.4.1.30221.2.5.45
1.3.6.1.4.1.30221.2.5.46
1.3.6.1.4.1.30221.2.5.48
1.3.6.1.4.1.30221.2.5.5
1.3.6.1.4.1.30221.2.5.51
1.3.6.1.4.1.30221.2.5.52
1.3.6.1.4.1.30221.2.5.54
1.3.6.1.4.1.30221.2.5.55
1.3.6.1.4.1.30221.2.5.56
1.3.6.1.4.1.30221.2.5.57
1.3.6.1.4.1.30221.2.5.58
1.3.6.1.4.1.30221.2.5.6
1.3.6.1.4.1.30221.2.5.60
1.3.6.1.4.1.30221.2.5.61
1.3.6.1.4.1.30221.2.5.63
1.3.6.1.4.1.30221.2.5.66
1.3.6.1.4.1.30221.2.5.67
1.3.6.1.4.1.30221.2.5.9
1.3.6.1.4.1.42.2.27.8.5.1
1.3.6.1.4.1.42.2.27.9.5.2
1.3.6.1.4.1.42.2.27.9.5.8
1.3.6.1.4.1.4203.1.10.2
1.3.6.1.4.1.7628.5.101.1
2.16.840.1.113730.3.4.12
2.16.840.1.113730.3.4.16
2.16.840.1.113730.3.4.17
2.16.840.1.113730.3.4.18
2.16.840.1.113730.3.4.19
2.16.840.1.113730.3.4.2
2.16.840.1.113730.3.4.3
2.16.840.1.113730.3.4.9
SupportedSASLMechanisms:
EXTERNAL
PING-IDENTITY-INTER-SERVER
PLAIN
UNBOUNDID-CERTIFICATE-PLUS-PASSWORD
UNBOUNDID-EXTERNALLY-PROCESSED-AUTHENTICATION
UNBOUNDID-TOTP
SubschemaSubentry: cn=schema
SupportedExtension:
1.3.6.1.1.21.1
1.3.6.1.1.21.3
1.3.6.1.1.8
1.3.6.1.4.1.1466.20037
1.3.6.1.4.1.30221.1.6.1
1.3.6.1.4.1.30221.1.6.2
1.3.6.1.4.1.30221.1.6.3
1.3.6.1.4.1.30221.2.6.1
1.3.6.1.4.1.30221.2.6.10
1.3.6.1.4.1.30221.2.6.13
1.3.6.1.4.1.30221.2.6.14
1.3.6.1.4.1.30221.2.6.15
1.3.6.1.4.1.30221.2.6.17
1.3.6.1.4.1.30221.2.6.2
1.3.6.1.4.1.30221.2.6.26
1.3.6.1.4.1.30221.2.6.28
1.3.6.1.4.1.30221.2.6.43
1.3.6.1.4.1.30221.2.6.47
1.3.6.1.4.1.30221.2.6.52
1.3.6.1.4.1.30221.2.6.56
1.3.6.1.4.1.30221.2.6.58
1.3.6.1.4.1.30221.2.6.62
1.3.6.1.4.1.30221.2.6.64
1.3.6.1.4.1.30221.2.6.8
1.3.6.1.4.1.4203.1.11.1
1.3.6.1.4.1.4203.1.11.3
164.95.88.80 treasury ldap
Ports open: 389, 636
62.10.18.149 govlab rdp sqlnode2
OS Build: 10.0.20348 Target Name: GOVLAB NetBIOS Domain Name: GOVLAB NetBIOS Computer Name: SQLNODE2 DNS Domain Name: govlab.corp DNS Tree Name: govlab.corp FQDN: SQLNODE2.govlab.corp
OS Build: 10.0.20348
Target Name: GOVLAB
NetBIOS Domain Name: GOVLAB
NetBIOS Computer Name: SQLNODE2
DNS Domain Name: govlab.corp
DNS Tree Name: govlab.corp
FQDN: SQLNODE2.govlab.corp
Officer Details :: OpenCorporates edward coristine
Officer details for TESLA.SEXY LLC
26 LAKEVIEW AVE, NEW CANAAN, CT, 06840, United States
Treasury PKI Homepage - no SNI, no HTTPS, ripe for TLS reflection attack....?!
Elon Musk's DOGE aims to hack the IRS and create a single API for easy access to U.S. taxpayer data - SiliconANGLE
Wired cites its sources as saying that Corcos wants the IRS to pause all of its ongoing engineering work and cancel efforts to modernize its existing computer systems.
On March 1, The Washington Post reported that Corcos had personally intervened, ordering the IRS to remove restrictions it had placed on Kliger’s access to its systems, and shortly after proposed an agreement that would enable IRS data to be shared across multiple government agencies.
However, a March 14 letter from Senator Ron Wyden to the IRS and others suggests that this request was declined. In the letter, Wyden praised the “rightful rejection” of Corcos’ request, and goes on to cite a second Post story that claims Trump administration officials are trying to access IRS data to aid in their immigration crackdown, as well as their government efficiency efforts.
With regards to the hackathon, Corcos is believed to be intent on creating “one API to rule them all,” and ensure that IRS data can be easily accessed via cloud platforms, Wired reported.
The API would first be applied to the IRS’ mainframes, and would later be expanded to its other internal systems, which are spread across dozens of on-premises data centers and compartmentalized cloud environments. At present, access to these systems is highly restricted, and IRS workers are only given permission to do so on a “need-to-know” basis.
DOGE wants the API to be built within just 30 days, but according to one IRS employee who spoke to Wired, that deadline is “not technically possible” and would likely “cripple” the IRS’s systems.
20.141.121.78 motorola redaction integrate-tes
Ports open: 4433, 5986, 9000
tesla.sexy - urlscan.io Feb 7 2025 first time this poem appeared that we know of poem
urlscan.io - Website scanner for suspicious and malicious URLs
tesla.sexy - urlscan.io stupid poetry
urlscan.io - Website scanner for suspicious and malicious URLs
Hey, That’s Not My Server! | Censys Research on BGP Hijacking censys blog
Discover how Censys researchers detected a massive BGP hijacking campaign that misdirected traffic through rogue servers. Learn how this impacts internet security and what it means for your infrastructure.
National Cyber Security Centre GCHQ SparrowDoor report
FamousSparrow: A suspicious hotel guest important
Yet another APT group that exploited the ProxyLogon vulnerability in March 2021
The connections could be either through a proxy or not, and they connect to the C&C server over port 443 (HTTPS). So, the communication should be encrypted using TLS. During the first attempt to contact the C&C server, SparrowDoor checks whether a connection can be established without using a proxy, and if it can’t, then the data is sent through a proxy.
SparrowDoor collects the username, computername, RDP session ID, and drive types in the system and sends this data to the C&C server.
SparrowDoor communicates with the C&C server using the HTTPS protocol.
SparrowDoor exfiltrates data over its C&C channel.