TI-2026-033G ยท 26 Jun 2026 ยท Threat Intelligence
The Stresser Layer
In 033F, a DDoS attack targeting phishdestroy.io revealed the attacker's motive: the anti-phishing platform was monitoring two domains โ satellitestress.st and terrastress.st. Tracing those domains backward exposes a DDoS-for-hire empire hidden inside a CDN company.
Executive Summary
DiamWall (AS207731, 216.146.31.0/24, Lisbon PT) sells CDN and DDoS protection. It simultaneously operates a cluster of DDoS-for-hire services โ stresse.st, stresser.st, satellitestress.st, shutdown.st, goliathstress.tr, deepstresser.su โ all resolving to its own IP (216.146.31.1) served by its own nameservers (chip.diamwall.com / runah.diamwall.com). A parallel stresser (terrastress.st) runs on infrastructure belonging to Internet Magnate (Pty) Ltd, South Africa (AS214209), under ZeroShield branding.
The Sรฃo Tomรฉ and Prรญncipe .ST ccTLD is deliberately exploited: stress + .st = a natural brand suffix. The multi-jurisdictional spread across .ST, .TR (Turkey), and .SU (Soviet Union) is a resilience strategy against takedown. CEO Hugo Carvalho and CTO Miguel Miranda are the named persons behind DiamWall. Their operational contacts use an Oman (+968) number; abuse routing goes to Yemen (+967).
The May 16, 2026 DDoS on phishdestroy.io โ 1.67B requests from 197K IPs, targeting /domain/satellitestress.st/ โ was the operators attacking an anti-phishing service that was monitoring their own stresser domains.
1 โ The Company That Sells Both Sides
DiamWall positions itself as a CDN and DDoS mitigation provider โ a Cloudflare-adjacent service offering "Verifying your browser" bot protection, a content delivery network, and DDoS scrubbing. Its ARIN registration (org: DIAMW) dates to 2022-10-30. IP space 216.146.31.0/24 was reallocated from August Internet, a Canadian upstream.
The ARIN registration lists separate phone numbers by function. All technical functions share one number; abuse handling uses a different country entirely:
All operational contact routed through Oman. This is where the infrastructure is actually managed.
Abuse complaints routed to Yemen. Separate jurisdiction, maximum friction for abuse reporters.
The structural contradiction
A company that sells DDoS protection and simultaneously operates DDoS-for-hire services is not running two independent businesses. It is running both sides of a protection racket. The infrastructure is identical โ same IP, same nameservers. The only separation is the brand name.
2 โ The DiamWall Stresser Cluster
All domains on 216.146.31.1 with DiamWall nameservers (chip.diamwall.com / runah.diamwall.com). Verified via live DNS and NIC.ST WHOIS.
The awesomedbaccess.shutdown.st subdomain is a naming pattern consistent with a database access panel โ a control interface for the stresser backend. Its exposure in passive DNS suggests the operators did not restrict subdomain enumeration.
3 โ The .ST TLD as Brand Architecture
Sรฃo Tomรฉ and Prรญncipe (.st) is a microstate of 225,000 people off the coast of Gabon. Its ccTLD is administered by the Telecommunications Regulatory Authority and managed commercially under the NIC.ST brand. The TLD is unremarkable except for one property: when appended to stress, stresser, stresse, satellite, or goliath, it forms a self-describing DDoS-for-hire brand name.
| Domain | TLD | Registrar | Created | Takedown risk |
|---|---|---|---|---|
| stresse.st | .ST | ST Registry (direct) | 2025-03-14 | Low โ microstate, limited international cooperation |
| stresser.st | .ST | NiceNIC | 2025-12-01 | Low + transfer-locked |
| satellitestress.st | .ST | StanCo / Istanco | 2025-11-19 | Low |
| shutdown.st | .ST | NiceNIC | 2025-10-16 | Low + transfer-locked |
| terrastress.st | .ST | StanCo / Istanco | 2026-04-18 | Low |
| goliathstress.tr | .TR | Turkish registry | unknown | Medium โ requires Turkish court order |
| deepstresser.su | .SU | TCI (Russia) | 2025-07-24 | Very low โ .SU administered by Russian registrar, resistant to Western enforcement |
stresse.st was registered directly at ST Registry โ the NIC.ST operator โ not through a third-party registrar. This is significant. Most domain registrations flow through accredited resellers. A direct NIC.ST registration suggests either a reseller relationship, bulk registration access, or an established account with the registry. It also means the privacy protection (STR-WHOISPRIVACY) is applied by the registry itself, not a third party โ giving the operator maximum insulation from registrant disclosure requests.
Multi-TLD resilience strategy
The spread across .ST (Sรฃo Tomรฉ), .TR (Turkey), and .SU (Soviet Union) is not cosmetic. Each jurisdiction requires a separate legal process to execute a takedown. .SU domains in particular are administered by TCI in Moscow and have historically ignored international enforcement requests. By distributing across three ccTLDs that do not cooperate with each other, the operators ensure that taking down any single domain does not shut down the service.
4 โ Construction Timeline
5 โ Internet Magnate: The South African Node
terrastress.st runs on a parallel infrastructure track. IP 94.156.152.9 (PTR: sec.managedsrv.st) belongs to Internet Magnate (Pty) Ltd (RIPE ORG-IA2087, AS214209), incorporated in Centurion, South Africa. The company was registered in RIPE on 2024-08-22.
| Field | Value |
|---|---|
| Organization | Internet Magnate (Pty) Ltd |
| Address | 1 Bondev Dr, Centurion, South Africa |
| ASN | AS214209 (AS-INTERNETMAGNATE) |
| RIPE Org ID | ORG-IA2087 |
| RIPE MNT-REF | FIVE_CYBER_HOST_SECURITY-MNT ยท SBL-MNT |
| IP (stresser) | 94.156.152.9 |
| PTR record | sec.managedsrv.st |
| Default page | "ZeroShield ON" โ ZeroShield branding |
| NS typo | WHOIS for managedsrv.st shows "managedrsv.st" (non-existent domain) in NS records |
The reverse IP lookup on 94.156.152.9 reveals the full co-tenant profile:
| Domain | Classification | Note |
|---|---|---|
managedsrv.st | operator | Management infrastructure โ load/mail/sec/uptime/www subdomains |
terrastress.st | stresser | DDoS-for-hire โ api/captcha/mnt subdomains |
zeroguard.id | suspect | ZeroGuard โ matches ZeroShield branding on managedsrv.st |
waffen.ss | extremist | .SS = South Sudan TLD. "Waffen SS" is a Nazi reference. Active domain on this server. |
seur-es.info | phishing | SEUR is a Spanish courier company. seur-es.info = delivery phishing domain. |
pokera.pe | gambling | Poker platform with booking subdomains |
mailman.pw | suspect | Anonymous mail service โ .PW (Palau) TLD |
waffen.ss โ Nazi domain on stresser infrastructure
The domain waffen.ss (using the South Sudan .SS ccTLD) is a direct reference to the Waffen-SS, the armed wing of the Nazi party. This domain is active on the same server as terrastress.st. Its presence alongside a DDoS-for-hire service, phishing infrastructure, and gambling operations characterizes the tolerance threshold of Internet Magnate's hosting environment: unrestricted, no content moderation, clientele including extremist content alongside criminal services.
6 โ The Self-Referential Attack
In 033F, we documented a DDoS attack on phishdestroy.io on May 16, 2026 โ 1.67 billion requests sourced from 197,000 IPs, targeting two specific URL paths:
| Target Path | Domain Monitored | Operator |
|---|---|---|
/domain/satellitestress.st/ |
satellitestress.st | DiamWall |
/domain/terrastress.st/ |
terrastress.st | Internet Magnate |
phishdestroy.io is an anti-phishing monitoring service. Its /domain/ path provides reputation and abuse tracking for submitted domains. The DDoS was not random โ it targeted the specific reputation pages for the two stresser domains that the operators were trying to suppress from monitoring.
Using your own product against your critics
A stresser service attacked an anti-phishing monitor using a DDoS โ almost certainly using the stresser service's own infrastructure. This is the most literal possible conflict of interest: the product is used to protect the product from being documented. The target selection (specific /domain/ paths, not the homepage) confirms this was not opportunistic. The attacker knew exactly what they were suppressing.
The shutdown.st domain was also updated on 2026-05-16 โ the same day as the attack. Whether this is coincidental maintenance or reflects operational activity around the attack window is unclear, but the timing is noted.
Questions & Findings
How do we know DiamWall operates the stresser domains and not merely hosts them for a customer?
DiamWall's own nameservers (chip.diamwall.com / runah.diamwall.com) serve all five primary stresser domains. Nameserver delegation is not a service DiamWall offers to generic customers โ it requires the operator to add NS records within their own zone. A CDN customer would use DiamWall as a proxy, not as their authoritative DNS provider under DiamWall's own subdomain. The nameserver evidence places DiamWall in the role of DNS operator, not just transit.
Is there a connection between DiamWall and Internet Magnate / terrastress.st?
No direct infrastructure link is confirmed. They share the .ST TLD strategy, the Istanco/StanCo registrar, and were both targeted by the May 16 phishdestroy.io DDoS. They may be independent stresser operators who discovered the same .ST brand formula, or they may have a relationship that is not yet reflected in DNS or WHOIS records. The evidence supports parallel actors in the same ecosystem rather than a single command structure.
Why does DiamWall use Oman for operations and Yemen for abuse?
The separation appears deliberate. Oman (+968) is used for all functional contacts: NOC, technical, routing, DNS. These are the people who actually run the network. Yemen (+967) is listed only for abuse โ the contact point for complaints. Yemen's ongoing infrastructure crisis means that a phone number in Yemen has extremely limited reachability for international abuse reporters. This is not an accident of geography; it is friction-by-design.
What is the significance of stresse.st being registered at ST Registry directly?
Most domain registrations use accredited resellers (NiceNIC, GoDaddy, Namecheap, etc.) as intermediaries. Registering directly at the ccTLD operator (NIC.ST) is unusual and suggests either an established reseller relationship or access to the registry's EPP (Extensible Provisioning Protocol) interface. This would explain how DiamWall obtained the STR-WHOISPRIVACY privacy service โ applied by the registry itself โ rather than a third-party anonymization service. It implies a closer relationship with the .ST registry than a typical domain registrant would have.
What should law enforcement or researchers do with this information?
DiamWall is an ARIN-registered organization with a disclosed Lisbon address and named officers. Hugo Carvalho and Miguel Miranda are identified by name in public records. Portugal is an EU member state with functional law enforcement cooperation frameworks (ENISA, Europol). The ARIN registration, combined with documented stresser domain operation on DiamWall nameservers, provides a traceable paper trail. The Kiwifarms incident in 2022 establishes a prior record of public accountability pressure having effect. A referral to ARIN or RIPE for network abuse, combined with a Portuguese law enforcement referral, represents the clearest path toward administrative action.
Assessment
DiamWall (AS207731, 216.146.31.0/24, Lisbon PT) is a dual-use criminal infrastructure provider. Its public face โ CDN and DDoS protection โ coexists with the operation of at least six DDoS-for-hire stresser services on the same IP and nameservers. Hugo Carvalho (CEO) and Miguel Miranda (CTO) are the named operators. The .ST ccTLD is exploited deliberately as a brand suffix; the multi-TLD spread across .ST/.TR/.SU is a premeditated takedown-resilience strategy.
Internet Magnate (Pty) Ltd (South Africa, AS214209) operates the parallel terrastress.st node under ZeroShield branding alongside phishing infrastructure, an extremist domain, and gambling services โ characterizing a bulletproof-adjacent hosting environment.
The May 16, 2026 DDoS on phishdestroy.io was a stresser operator using its own tools to silence a platform that was documenting its own services. The attack succeeded technically. The documentation continues regardless.
Series Cross-References
- 033A โ The Psychedelic Connector โ origin identity, 2cb.li, Tor exit relay operator
- 033B โ The Scale โ 49+ Tor relays, NymDNS, AS47583 (Hosting Moldova)
- 033C โ The Substrate โ Satanist operator, Mynymbox LLC, Njalla infrastructure
- 033D โ The Saint Kitts Connection โ offshore registration, Caribbean shell structure
- 033E โ The Operators โ em, maxzrbn, secretdrop.to, PGP warrant canary
- 033F โ The Payload โ 45.154.98.153, HiddenPhish SSL, egrul.nalog.ru Russian actor signal, phishdestroy.io DDoS origin