NoName057(16), a pro-Russian hacktivist group, claims it knocked Spanish government and business websites offline on 6 November 2026 under the tag OpSpain. The group posted the same claim across its own Telegram channels in Russian, Italian, Spanish, French and English, which is the source for this alert.
This is an unverified claim. Brandefense Blackhole holds the group’s own posts. No named body had confirmed or denied them as of 6 November 2026.
What Does the NoName057(16) OpSpain Claim Say?
Early on 6 November, NoName057(16) posted that it had struck Spain’s administrative and business infrastructure. The posts name three Spanish targets, each said to be down:
- The Basque Parliament’s website, said to be closed by geolocation.
- The electronic office of La Coruña municipality, said to be dead by ping.
- The Chamber of Commerce, Industry and Services of Madrid, named with no stated cause.
As proof, the posts link reports from a public website availability checker. The group frames the claim as mockery, pointing to earlier, unrelated disputes over EU funds and local budgets in the same places.
Later the same day, a second set of posts in the same five languages claims that Palma and Santiago de Compostela are completely offline. These posts also link checker reports as proof, under the group’s OpSpain tag.
Is the NoName057(16) OpSpain Claim Confirmed?
No. Brandefense Blackhole holds 31 posts matching OpSpain over the past three months, almost all of them from this week. Eleven came on 5 November and thirteen on 6 November, which is nearly all the volume in the two days of these claims.
A wider search for the group’s own name returns 934 posts in the same window. That volume shows how often NoName057(16) posts about many operations, not only this one.
- Posted across the actor’s own channelsYesNoName057(16) posted the same text in Russian, Italian, Spanish, French and English channel versions.2026-11-06
- Confirmation from a named targetUnknownNo statement from the Basque Parliament, La Coruña, Madrid’s Chamber of Commerce, Palma or Santiago de Compostela, as of 6 November 2026.2026-11-06
- Brandefense Blackhole volumeYes31 posts match OpSpain in our 90-day window, 24 of them on 5 and 6 November.2026-11-06
A checker report of this kind shows that a test request went unanswered at one moment. It does not show how long an outage lasted, what caused it, or whether the group’s screenshots tell the full story. A group publishes only the reports that support its own claim.
What Should Named Spanish Sites Do Now?
The steps below are our advice, not findings from the group’s posts. They apply whether or not this particular claim proves true, since a DDoS claim like this one is cheap to make and easy to repeat.
- Check your own logs firstBefore replying to the claim, check your own availability monitoring and server logs for the times the group posted.
- Verify with an independent sourceA checker screenshot shows one moment, not duration or cause. Confirm from your own monitoring before you comment.
- Keep DDoS mitigation readyAgree with your hosting or CDN provider on traffic filtering and a fallback page if this is not already in place.
- Separate public pages from back-office systemsA city portal outage should not be able to reach case-management, tax or voting systems.
- Watch the tag for your own nameOpSpain posts keep arriving. Monitor for further named targets so a new claim does not catch you off guard.
For how the same group has run this kind of campaign before, see our record of NoName057(16)’s DDoS campaigns against Italy. We will update this alert if a named body confirms or denies the OpSpain claim.