Traffic service & campaign optimization ◆ Private Crypter - Unique Private Stubs ◆ ZexoCard: no-KYC virtual crypto cards ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Remote Administration Tools › [MUST READ] Weird DuckDNS subdomain takeover

New Reply 

[MUST READ] Weird DuckDNS subdomain takeover
QU⚡CKSILVER
QU⚡CKSILVER Offline
[closed@HF:]
Posts:
1,688
Threads:
36
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
1
Jul 20, 2015 09:06 PM (This post was last modified: Jul 21, 2015 01:03 AM by QU⚡CKSILVER.)
Today I found out that DuckDNS owners/admins had taken control over a subdomain that I registered on there a year ago.. It had been working ever since and many of my clients are still resolving this subdomain, but guess what? DuckDNS has taken control over my subdomain now for an unknown reason. (I assume it is to check if it's being used for a botnet... Don't know to be honest).

How it all started? Well, basically, my DuckDNS updater had problems updating the subdomain and it was showing the following error:
[Image: f98a50c9b5404ba52fd6962974b1b1da.png]

Okay then... I was wondering why it was happening, so I managed to go to DuckDNS site and surprisingly saw that the registered subdomain was not in the list (deleted)... I tried to add it again, but Oh... BIG SURPRISE. Just look below, lol.

[Image: 2277e133eda423098b32051b4529b6bf.png]

After seeing this crap, I was like ''What the heck, how is that even possible? Why would I delete my own subdomain? How come it is now taken by another user?''

Before judging this situation as a TAKEOVER from DuckDNS admins, I managed to resolve the domain above to find out if it was still alive, where it is now pointing to and perform a port scan on it.

Turns out the domain is now pointing to: 192.169.69.25 and it has the port 80 open.

IPWHOIS: [Image: b7ba70be3e568ef0a1ca38060376d510.png]

When I saw the port 80 was open, I knew it had to be a webserver running on that IP address and of course, I opened a new tab and went to http://labrechadera.duckdns.org/ just for curiosity and GUYS, what you're going to see will make you stop using DuckDNS immediately...

[Image: bd99d96ba010a640c206ff0e631e766f.png]

Okay, so I guess this is definetely telling me everything I wanted to know... ''Modern Honeypot Network Server''

More info on ThreatStream and their ''Modern Honeynet Framework'' project here: Spoiler (Click to View)

DuckDNS is no longer safe for RATs/botnets. BEWARE!! If you still don't trust me, you can just do an HTTP request on the IP mentioned above (which is where my subdomain is currently pointing to) and see it for yourself.

To make a long story short, my subdomain (labrechadera.duckdns.org) was basically taken down by DuckDNS administrators because they want to find out if I was using it for malicious purposes (technically I was) but all I can say is to stop using DuckDNS for Remote Administration Tools/Botnets, as you could be surprised someday.
๖ۣۜSyria
๖ۣۜSyria Offline
[closed@HF:]
Posts:
4,996
Threads:
406
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 20, 2015 09:14 PM (This post was last modified: Jul 20, 2015 09:15 PM by ๖ۣۜSyria.)
I came here for a video! And some one probebly just paid them to get ur sub domain and wanted to scare you
eidt:wow they found 10,300,426 infected computers
BahNahNah
BahNahNah Offline
Yikes, too edgy bro
***
HF Ub3r
Posts:
3,214
Threads:
102
Credibility:
000
Popularity:
221
βytes:
β 0
Game XP:
749
Jul 20, 2015 09:18 PM
(Jul 20, 2015 09:14 PM)๖ۣۜSyria Wrote:  I came here for a video! And some one probebly just paid them to get ur sub domain and wanted to scare you
eidt:wow they found 10,300,426 infected computers

Its possible that duckdns is cracking down.
OP, how many computers did you have connecting to the DNS?
Lotta blood to let, peace to make, give a fuk about a check
QU⚡CKSILVER
QU⚡CKSILVER Offline
[closed@HF:]
Posts:
1,688
Threads:
36
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
1
Jul 20, 2015 09:50 PM (This post was last modified: Jul 20, 2015 09:54 PM by QU⚡CKSILVER.)
(Jul 20, 2015 09:18 PM)BahNahNah Wrote:  Its possible that duckdns is cracking down.
OP, how many computers did you have connecting to the DNS?

Well, I must say I have like 10 people resolving that subdomain right now, and they're all from my country (Dominican Republic)

(Jul 20, 2015 09:14 PM)๖ۣۜSyria Wrote:  I came here for a video! And some one probebly just paid them to get ur sub domain and wanted to scare you
eidt:wow they found 10,300,426 infected computers

Why would you need a video? I didn't record anything, just showing proof that DuckDNS is somehow taking over subdomains for investigation.
d4rkito
d4rkito Offline
[n00b@HF:]
*
Registered
Posts:
77
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 20, 2015 09:54 PM (This post was last modified: Jul 20, 2015 09:55 PM by d4rkito.)
Seems curious. This could be an important info for us, thanks!
SiNdicate
SiNdicate Offline
CEO of all CEOs
**
HF l33t
Posts:
157
Threads:
6
Credibility:
100
Popularity:
5
βytes:
β 0
Game XP:
0
Jul 21, 2015 12:46 AM
Thanks for looking out! You probably saved the asses of a lot of people.
N3wb Gamer
N3wb Gamer Offline
[bin@HF:]
***
HF Ub3r
Posts:
2,724
Threads:
294
Credibility:
600
Popularity:
81
βytes:
β 29
Game XP:
0
Jul 22, 2015 08:44 AM
This just happened to me. Does anyone recommend another dns server?
๒lคςк ςคt
Guest
 
Jul 22, 2015 08:45 AM
my dns got closed too
but when you ping it does to 1.1.1.1(dns is : alienware123.duckdns.org)
QU⚡CKSILVER
QU⚡CKSILVER Offline
[closed@HF:]
Posts:
1,688
Threads:
36
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
1
Jul 22, 2015 11:08 AM (This post was last modified: Jul 22, 2015 11:09 AM by QU⚡CKSILVER.)
(Jul 22, 2015 08:44 AM)N3wb Gamer Wrote:  This just happened to me. Does anyone recommend another dns server?


To be honest, I'd recommend to stay away from Free DNS providers, as they might do the same DuckDNS just did in the future.

(Jul 22, 2015 08:45 AM)๒lคςк ςคt Wrote:  my dns got closed too
but when you ping it does to 1.1.1.1(dns is : alienware123.duckdns.org)

Your subdomain is pointing to the same IP address of mine:

[Image: a696a3c4514f6b75ae2d78a129a7c0ec.png]
SIM-2163220
SIM-2163220 Offline
123
**
HF l33t
Posts:
242
Threads:
41
Credibility:
200
Popularity:
3
βytes:
β 30.15
Game XP:
52
Jul 22, 2015 11:44 AM
Just lost over 10k slaves.

Fuck this shit, I lay down this career now.
IAmExploit
IAmExploit Offline
[closed@HF:]
Posts:
109
Threads:
6
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 22, 2015 02:27 PM
(Jul 22, 2015 11:44 AM)SIM-2163220 Wrote:  Just lost over 10k slaves.

Fuck this shit, I lay down this career now.

Sorry for your loss, man. :(
Wolf of Wall Street
Wolf of Wall Street Away
[closed@HF:]
Posts:
482
Threads:
98
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 22, 2015 03:18 PM
(Jul 22, 2015 11:44 AM)SIM-2163220 Wrote:  Just lost over 10k slaves.

Fuck this shit, I lay down this career now.

omg thats awful 😟

duckdns was good for me cause im a newbie and it was easy to use
©Ratatouille™
©Ratatouille™ Offline
Rata Protector Released
***
HF Ub3r
Posts:
1,124
Threads:
37
Credibility:
000
Popularity:
7
βytes:
β 0
Game XP:
0
Jul 22, 2015 04:28 PM
mother fucker lost 1k http://mediafire.duckdns.org

Alternative DNS ?

No ip = Ban

DNS exit = Ban

DuckDns = Ban
[Image: tIUCpQ.gif]
SiNdicate
SiNdicate Offline
CEO of all CEOs
**
HF l33t
Posts:
157
Threads:
6
Credibility:
100
Popularity:
5
βytes:
β 0
Game XP:
0
Jul 22, 2015 10:09 PM
Well, FreeDNS is pretty decent, but it's really the only one i've ever used. No problems with it and I would suggest it.
Armada
Armada Away
[closed@HF:]
Posts:
22,584
Threads:
642
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 22, 2015 11:31 PM
(Jul 22, 2015 11:22 PM)Odinz Wrote:  Which bot was using this host?

It seems to have more to do with the amount of traffic ging through the domains, not the type of traffic.

I looked in to this earlier.
https://hackforums.net/showthread.php?tid=4917395
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by hoangdoanJun 20, 2025 02:54 PM 6 632 Jun 20, 2025 02:54 PM
Last Post: I_H8_KDot
by D33PN3TFeb 28, 2021 03:06 PM 5 189 Feb 28, 2021 03:06 PM
Last Post: D33PN3T
by ninfaarunaOct 28, 2019 12:50 AM 7 376 Oct 28, 2019 12:50 AM
Last Post: ninfaaruna