+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [DuckDNS & Deployment of MHN] ABANDON USE OF DUCKDNS - Updated: July 31 2015 (/showthread.php?tid=4917395)
[DuckDNS & Deployment of MHN] ABANDON USE OF DUCKDNS - Updated: July 31 2015 - Armada - Jul 22, 2015
Starting today I noticed a starting trend of threads happening
[ MUST READ ] Weird DuckDNS subdomain takeover
DuckDNS
It was the mention of the Modern Honeypot Network Server that caught my attention and investigation in to this a little bit.
It would appear as though either Duck DNS themselves or another entity has deployed a Threats Management Server known as "MHN" - Modern Honeypot Network. an open source threat analytic interface and audit solution.
Description:
Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
Spoiler (Click to View)
Source and Source Code
It would appear as though these are deployed honeypots to determine the type of traffic being passed through these subdomains.
All users would be advised to abandon use of DuckDNS and\or accounts associated to the registration of the DNS service.
CONFIRMED
DuckDNS is taking proactive steps to reduce malware being passed through its services: Source
Google+ Social Postings
POINT OF NOTE:
Dont go posting this to their social wall.. that is just stupid. C'mon guys.
Spoiler (Click to View)
DuckDNS is taking proactive steps to reduce malware being passed through its services: Source
Google+ Social Postings
POINT OF NOTE:
Dont go posting this to their social wall.. that is just stupid. C'mon guys.
Spoiler (Click to View)
![[Image: aG0mYDa.png]](https://i.imgur.com/aG0mYDa.png)
\\Update
Analysis of designated IP#
- Pointed IP# appears to be the central management consoles interface.
Minimal exposure, but should not be on exterior of DuckDNS network.
Spoiler (Click to View)
![[Image: BmCaOl1.png]](https://i.imgur.com/BmCaOl1.png)
\\2nd Update
Spoiler (Click to View)
\\3rd Update
(Jul 29, 2015 03:16 PM)๖ۣۜDeathStr0ke Wrote: The guy who helped sinkhole all the domains mentioned a collection domains used for malware, the link is here if you want to check for yours or whatever..
\\4th Update
(Jul 31, 2015 01:50 AM)geezus Wrote: How exactly is jumping ship to another free dns provider going to help?
Nobody uses backup DNS after the NO-IP bullsh1t?!?!?
When no-ip went down everyone migrated to duckdns, so using freedns will only delay your fate.
Ive been using duckdns and all my domains are in that list.
changeip = banned
freedns =banned
duckdns =honeypot
no-ip =honeypot
I think its safe to say that if your going to be doing anything criminal it might be a good idea to invest in some OPSEC and use your own DNS.
Think of it like a botnet do you use free hosting that can be banned/shutdown/reported easily.....NO
SO go the extra mile and buy a cheap vps to setup your own DNS
Here is an update client that works wit a large number of DynDNS providers.
http://www.directupdate.net/
Spoiler (Click to View)
🤝
* - LSDoom - Jul 22, 2015
Thanks for sharing this. Will definitely get rid of my DuckDNS account and client.
* - QU⚡CKSILVER - Jul 22, 2015
Thanks for the feedback regarding their Honeynet project for analyzing new threats. PEOPLE BE AWARE, don't use this shit ever again! This situation reminds me of what happened with NoIP...
Dang it! I had put my trust in DuckDNS for over a year, but now they've just gone bitchy
* - professoraegon - Jul 22, 2015
Thanks for the heads up. Thats too bad as duckdns was really working great. Any suggestions on where we should be migrating?
* - LSDoom - Jul 22, 2015
(Jul 22, 2015 10:22 AM)professoraegon Wrote: Thanks for the heads up. Thats too bad as duckdns was really working great. Any suggestions on where we should be migrating?
I see a lot of people are using FreeDNS. I have no personal experience with that service though. Stay away from NO-IP, that's all I got to say.
* - Armada - Jul 22, 2015
Users who utilize RA4WVPN services, I have created some DNS pointers for use.
// Click Here to View The Spreadsheet //
Hope this helps some users. 🤝
* - ©Ratatouille™ - Jul 22, 2015
mother fucker lost 1k http://mediafire.duckdns.org
No ip = Ban
DNS exit = Ban
DuckDns = Ban
Now go freedns
* - Eternal. - Jul 22, 2015
Id use Free DNS instead. How to setup a Dynamic DNS – An Alternative to no-IP
* - ๖ۣۜCyber - Jul 22, 2015
Thanks for the new DNS' for RA4W personally I use it so xD
Thanks again
* - Minato Namikaze - Jul 22, 2015
FreeDNS all the way, good thing I chose them along time ago ;)
* - GoodByeGoodGuys - Jul 22, 2015
Goddamn you Armada. Stop being so goddamn helpful and HQ......
* - xchg - Jul 22, 2015
Thanks for this man, will uninstall duckdns
* - SIM-1676753 - Jul 22, 2015
Someone should make custom DNS server for HF.
* - Minato Namikaze - Jul 22, 2015
(Jul 22, 2015 05:46 PM)Mr. Trvp Wrote: Someone should make custom DNS server for HF.
Wouldn't that be a bit, challenging?
I mean, ad revenue though lol
* - SIM-1676753 - Jul 22, 2015
(Jul 22, 2015 07:57 PM)Minato Namikaze Wrote: Wouldn't that be a bit, challenging?
I mean, ad revenue though lol
Hmm.. Blackhat money? Jokes, lol.