[Megabear]

Now this defo does not sound great OP..
take your hdd and destroy it lol.

[yotoprules]

Remove any traces of the RAT, delete your VPS account, do a full format of your hard drives to make sure.

[QU⚡CKSILVER]

This is the exact same thing DuckDNS did, but with a twist... Your particular domain was reported as malicious and Dynu was warned about it... Dynu Administrators pointed that domain to one of their endpoints to analyze the traffic coming in. They found out about your domain being used for a botnet, then pointed it back to your original IP address...

Slaves should still connect, unless they managed to uninstall them all for you by using the exact same RAT you're using (which is very unlikely to happen). What a DNS provider would've done is to simply suspend the domain, so that it becomes unresolvable... Just like DuckDNS did to all of us.

[Iraqian]

Very interesting!!!

Frontier com is telecommunications and Internet service provider. I work with them most of the time on priv8 duties. That's a real deal as it reached their HQ DPT. I hope you get out if this deal safely. Good luck.

[CichyCichoCiemny]

Well, crypt your drives.
🤝

[Sheeple]

Well, crypt your drives.
🤝

encrypting hdds would do nothing, they need to be wiped/destroyed if he's actually going to be in trouble.

[Maxie]

Don't crypt your drives. You want to totally format them; writing all 0s to the harddrive. Google for tools.

[Avira]

well this thread is bullshit, however, even if it is legit For someone to steal your domain reg account and point it to their own Ip for however long proves nothing, if they wanted you to have no bots they would've kept the domain pointed to their own server anyway

Also, they would have to know exactly what rat you're using otherwise there would be no way for him to issue commands to the infected machines. how about a name? (Of the "researcher")

[Katarina Du Couteau]

You are 100% fucked, someone is dedicated in finding you.
RiP

[Nickname.]

Well I am sure you got nothing to worry about since the feds wouldnt take your slaves they rather catch you when you maintain your clients.

[cashf]

Just as update:

- All looks pretty safe still (I don't want to elaborate details here, what exactly I did to prevent that the VPS company can get any info about myself, just I think that is was "enough")
- Nothing has been done with the vics. Setup was for a test only.
- VPS suspended my server couple days before. I realized that the RAT connected to the VPS-IP directly. This made the company suspend my VPS. The reason behind this was, that spamhaus listed my VPS IP as C&C server in a blacklist. Obviously they had send an abuse letter to my VPS company which caused them to take down my VPS.
- Disk of the VPS was completely overwritten at this time. Still VPS company took it down due to spamhaus abuse letter. VPS wasn't a bulletproof one.
- Also DNS and a Domain which I used got suspended.

Pretty harsh reaction, I know, anyway I think that the setup was relatively safe.

I think this can be closed now.

Have a great day!

[QU⚡CKSILVER]

So Dynu suspended your domain as well?

[cashf]

So Dynu suspended your domain as well?

Actually not, dynu was/is still standing. But 2 other backup DNS from alternative DNS providers had been gone. Also the VPS got suspended.

Dynu pointed the domain back to my original IP and dynu WAS and IS the last piece in this whole setup that is still standing. Now worthless of course.

Well... strange story, I will not use this dynu DNS from now on...

[JoshuTee]

Especially when this looks safe, it's best for your safety to uninstall all your clients and nuke your hard drive with DBAN.
It's frankly quite possible that your will get raided. A friend of mine was in a simulator situation and he DID in fact get raided

[Armada]

Really 3 pages for this?

@OP, your DNS got flagged and they null routed it to a honeypot.

Simple as that.