State networks DDOS (Vikingdom2015/TeamCyberPoison)

[Gary Warner <gar () CIS UAB EDU>]

Kevin, 

Thanks so much for sharing!

The second Pastebin link is incorrect.  The correct link for Maine IP addresses is:

pastebin.com/xvrfPGZf

I found it by searching for "VikingDom2015"

A post here:

pastebin.com/SsSayRqf

on March 25, 2015 lists "Sites taken down by Vikingdom2015/TeamCyberPoison" which includes Xboxlive and several ISIS 
websites.  They also claim they took down "fbi.gov" (for 2 minutes).

I have no idea (...yet...) what the motivation would be for a group that wants to take down both ISIS websites and 
State government websites.

----------------------------------------------------------

Gary Warner
Director of Research in Computer Forensics
The University of Alabama at Birmingham
Center for Information Assurance and Joint Forensics Research
205.422.2113
gar () cis uab edu

-----------------------------------------------------------

----- Original Message -----
From: "Kevin Halgren" <kevin.halgren () WASHBURN EDU>
To: SECURITY () LISTSERV EDUCAUSE EDU
Sent: Friday, March 27, 2015 8:08:29 AM
Subject: Re: [SECURITY] State networks DDOS




I found where the original reporter got the list from, so this is public, not proprietary information. Here you go: 



FYI state target list and Maine IP target list from pastebin (copied below in case they get pulled) 

http://pastebin.com/4FtKhSRN 

http://pastebin.com/9PViEkZy 



° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° 

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 

Destroy American 

@Vikingdom2015 Target List 3 / 23 / 2015 

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 

° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° ° 

maine. gov 

visitnh. gov 

mass. gov 

wyo. gov 

nyc. gov 

nc. gov 

sc. gov 

tn. gov 

ct. gov 

nj. gov 

pa. gov 

mo. gov 

in. gov 

wv. gov 

mn. gov 

nd. gov 

mt. gov 

az. gov 

sd. gov 

ca. gov 

nv. gov 

maryland. gov 

delaware. gov 

virginia. gov 

ohio. gov 

nebraska. gov 

kansas. gov 

texas. gov 

idaho. gov 

kentucky. gov 

illinois. gov 

iowa. gov 

wisconsin. gov 

myflorida. com 

michigan. gov 

georgia. gov 

alabama. gov 

mississippi. gov 

louisiana. gov 

arkansas. com 

colorado. gov 

newmexico. gov 

utah. gov 

oregon. gov 

--- 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

VIKINGDOM2015 

IP ADDRESSES MASSIVE LIST 

MAINE IP ADDRESSES 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

MAINE IP ADDRESSES 

EACH IP ADDRESS IS GOING TO GET DDOSED FOR 10 MINUTES! 

------------------------------------------------------ 

66.231.195.50 

24.39.63.117 

70.192.5.24 

74.75.53.89 

198.51.17.4 

74.75.55.107 

66.231.195.50 

208.125.207.10 

166.182.3.15 

74.75.206.102 

24.39.63.117 

67.255.227.45 

74.75.56.115 

24.39.63.117 

67.253.113.63 

166.181.3.188 

208.48.22.210 

66.3.25.154 

76.179.82.191 

67.255.244.56 

67.189.237.218 

208.125.207.10 

208.105.182.66 

66.186.190.130 

72.73.94.108 

174.236.33.204 

98.101.201.194 

67.253.23.66 

70.16.98.213 

64.223.170.121 

76.179.86.149 

66.231.195.50 

173.213.212.228 

76.179.82.191 

208.48.22.210 

208.105.182.66 

216.220.227.131 

66.3.25.154 

66.231.195.50 

74.78.64.78 

74.75.33.172 

76.179.6.219 

169.244.66.226 

67.253.113.63 

104.162.199.236 

70.192.4.113 

107.77.92.126 

72.73.94.108 

69.50.50.104 







From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Gary 
Warner 
Sent: Thursday, March 26, 2015 5:47 PM 
To: SECURITY () LISTSERV EDUCAUSE EDU 
Subject: Re: [SECURITY] State networks DDOS 




Can you share the list of prior and predicted attacks? 

Sent from my iPhone 



On Mar 26, 2015, at 1:07 PM, Kevin Halgren < kevin.halgren () WASHBURN EDU > wrote: 




If you haven’t seen already, there are apparently a series of large DDoS attacks going incrementally after state 
networks.. Not sure what impact it would have on us, if any. From what I’ve seen (and if I interpret it right) they 
appear to be going down a list and would hit Kansas.gov sometime between April 1 st and 3 rd assuming the current 
pattern holds. No guarantees, of course. 



Kevin Halgren 

Assistant Director – ITS Systems and Network Services & 

IT Security Officer 

Washburn University 

1700 SW College Ave 

Topeka, KS 66621 

785-670-2341