Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DDoSia, a participatory DDoS tool created by Russian hacktivists in 2022, is operated by the pro-Russian group NoName057(16). It relies on volunteers to contribute network resources for attacks, primarily targeting Ukraine, European allies, and NATO states. Censys has monitored DDoSia since mid-2025, observing an average of 6 control servers with short lifespans. The tool uses a multi-layered control infrastructure, with systems typically hosted on VPS providers. Despite law enforcement disruption in July 2025, DDoSia quickly reconstituted and resumed operations. The infrastructure is characterized by rapid changes, with most servers active for less than 24 hours. Attacks focus on government, military, transportation, public utilities, financial, and tourism sectors.

DDoSia is a distributed denial-of-service (DDoS) tool created by Russian hacktivists and operated by the pro-Russian group NoName057(16) since 2022. It functions as a participatory platform where volunteers contribute their network resources to amplify attack traffic. The infrastructure behind DDoSia is characterized by a multi-layered control system, typically hosted on virtual private servers (VPS) with very short lifespans, often less than 24 hours, to evade detection and takedown efforts. Censys monitoring since mid-2025 has observed an average of six control servers active at any time, which rapidly change to maintain operational continuity. The tool targets Ukraine, European allies, and NATO states, focusing on critical sectors such as government, military, transportation, public utilities, financial institutions, and tourism. Despite law enforcement disruption in July 2025, the infrastructure quickly reconstituted, demonstrating resilience and adaptability. The attack methodology involves leveraging volunteer resources rather than exploiting software vulnerabilities, relying on the collective bandwidth and computing power of participants. The threat is persistent and strategically aimed at destabilizing key infrastructure and allied nations, with a medium severity rating reflecting its disruptive potential balanced against the need for volunteer participation and lack of direct exploitation of vulnerabilities.

Detailed information about Investigating the Infrastructure Behind DDoSia's Attacks. Get real-time updates, technical details, and mitigation strategies.

Investigating the Infrastructure Behind DDoSia's Attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

Investigating the Infrastructure Behind DDoSia's Attacks

Threats Tagged 'ddosia'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ddosia'

Lead Pen Test Professional