[cashf]

Hey Guys,

I saw something REALLY interstesting:

1) I started with Ratting a few days before. Got a nice spreading method which got me round about 100 slaves every 24 hours. This went on for 2 days.

2) On day 2 some Security Researcher, not a famous one, but some guy posted a warning online about my spreading method and that people should not download my RAT's server. He also uploaded my server to virustotal and published a couple of comments on virustotal about my spreading method.

3) Now some REALLY strange thing happened: Thing is... I put 2 free DNS (dynu.com) into my RAT. Today I woke up and saw that all my slaves had been gone. My first assumption was, that the DNS got deleted. But surprisingly this was NOT the case. Both DNS still pointed to my VPS and it all looked pretty fine.

Now I started to research and found this:

The DNS (dynu.com) had pointed my DNS to some OTHER IP (!!!). IP belongs to "Frontier Communications Corporation California Santa Monica". This lasted for 2-3 hours yesterday and then they reverted the DNS BACK TO MY original VPS IP !!!

My thought is now: WHAT THE FUCK IS THIS ??? Someone seems to PLAY WITH ME... 😧

As far as my understanding goes... What could have happened is...

1) DNS pointed my RATs DNS to some other IP.
2) SOMEHOW they must have updated my slaves or did some other shit.

BECAUSE: Slaves do not connect any more. Slave count went from 200 to ZERO 😑😑

I am not angry about it, and I was expecting something like that. But I was expecting that they would just DELETE my DNS, but here, they seem to play some dirty game with me.

ANYONE EXPERIENCED SOMETHING LIKE THAT ??


Have a great Christmas guys...

cashf 🎉🎉

[DTK-C]

Hey Guys,

I saw something REALLY interstesting:

1) I started with Ratting a few days before. Got a nice spreading method which got me round about 100 slaves every 24 hours. This went on for 2 days.

2) On day 2 some Security Researcher, not a famous one, but some guy posted a warning online about my spreading method and that people should not download my RAT's server. He also uploaded my server to virustotal and published a couple of comments on virustotal about my spreading method.

3) Now some REALLY strange thing happened: Thing is... I put 2 free DNS (dynu.com) into my RAT. Today I woke up and saw that all my slaves had been gone. My first assumption was, that the DNS got deleted. But surprisingly this was NOT the case. Both DNS still pointed to my VPS and it all looked pretty fine.

Now I started to research and found this:

The DNS (dynu.com) had pointed my DNS to some OTHER IP (!!!). IP belongs to "Frontier Communications Corporation California Santa Monica". This lasted for 2-3 hours yesterday and then they reverted the DNS BACK TO MY original VPS IP !!!

My thought is now: WHAT THE FUCK IS THIS ??? Someone seems to PLAY WITH ME... 😧

As far as my understanding goes... What could have happened is...

1) DNS pointed my RATs DNS to some other IP.
2) SOMEHOW they must have updated my slaves or did some other shit.

BECAUSE: Slaves do not connect any more. Slave count went from 200 to ZERO 😑😑

I am not angry about it, and I was expecting something like that. But I was expecting that they would just DELETE my DNS, but here, they seem to play some dirty game with me.

ANYONE EXPERIENCED SOMETHING LIKE THAT ??


Have a great Christmas guys...

cashf 🎉🎉

have fun behind bars lmao

[Regulus]

Doesn't sounds good at all.
Be careful when it comes to ratting.

Not sure why this happened but I'd keep a low profile.

[Electrons]

Doesn't look good mate. Relocate or fry your station.

[Mitlar]

As the user mentioned above I would keep low and destroy any suspicious shit on your computer. Encrypt your hard drives.

[PixelatedBacon]

ur so donezo m9. Destroy ur hardware or overclock ur own PC :)

[NyQuil]

doubt they stole your bots as when you build a rats file it is unique when it comes to the matter of a program using the data being sent back as well as the delimiter and password. even if they changed the IP to theres its not likely their using the same rat and password you are to connect to the hardcoded file on the clients computer.

[Sheeple]

As the user mentioned above I would keep low and destroy any suspicious shit on your computer. Encrypt your hard drives.

Encrypting your hard drives would be the worst,and most pointless, thing to do.

[Rhez]

I think it's not possible to transfer the client to another because of the encrypted packets. 🤨 Maybe you just lost the slave because of the changing IP.

[JoshuTee]

They're probably going to try to steal your clients to uninstall your server

[Purple Kief]

"Frontier Communications Corporation California Santa Monica".

Research the shit out of that. If it's legit I'd prepare your butthole.

[eiqhtz]

"Frontier Communications Corporation California Santa Monica".

Research the shit out of that. If it's legit I'd prepare your butthole.

It's a telecommunications company. Provides internet, home phone, etc

https://en.m.wikipedia.org/wiki/Frontier_Communications

[Purple Kief]

It's a telecommunications company. Provides internet, home phone, etc

https://en.m.wikipedia.org/wiki/Frontier_Communications

So pretty much an internet provider redirrected all traffic to their servers?
OP if you are 100% sure about this you are screwed. No sugarcoating it lol.

[eiqhtz]

So pretty much an internet provider redirrected all traffic to their servers?
OP if you are 100% sure about this you are screwed. No sugarcoating it lol.

It could be that they're assisting in an investigation on OP as well.

[Ainaj]

It could be that they're assisting in an investigation on OP as well.

One can only wish