[DuckDNS & Deployment of MHN] ABANDON USE OF DUCKDNS - Updated: July 31 2015

Armada · (This post was last modified: Jul 31, 2015 11:01 AM by Armada.)

Starting today I noticed a starting trend of threads happening

[ MUST READ ] Weird DuckDNS subdomain takeover
DuckDNS

It was the mention of the Modern Honeypot Network Server that caught my attention and investigation in to this a little bit.

It would appear as though either Duck DNS themselves or another entity has deployed a Threats Management Server known as "MHN" - Modern Honeypot Network. an open source threat analytic interface and audit solution.

Description:

Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
Spoiler (Click to View)

Source and Source Code

It would appear as though these are deployed honeypots to determine the type of traffic being passed through these subdomains.

All users would be advised to abandon use of DuckDNS and\or accounts associated to the registration of the DNS service.

CONFIRMED
DuckDNS is taking proactive steps to reduce malware being passed through its services: Source
Google+ Social Postings
POINT OF NOTE:
Dont go posting this to their social wall.. that is just stupid. C'mon guys.
Spoiler (Click to View)

\\Update

Analysis of designated IP#
- Pointed IP# appears to be the central management consoles interface.
Minimal exposure, but should not be on exterior of DuckDNS network.

Spoiler (Click to View)

\\2nd Update
Spoiler (Click to View)

\\3rd Update

(Jul 29, 2015 03:16 PM)SIM-2198759 Wrote: The guy who helped sinkhole all the domains mentioned a collection domains used for malware, the link is here if you want to check for yours or whatever..

\\4th Update

(Jul 31, 2015 01:50 AM)geezus Wrote: How exactly is jumping ship to another free dns provider going to help?
Nobody uses backup DNS after the NO-IP bullsh1t?!?!?

When no-ip went down everyone migrated to duckdns, so using freedns will only delay your fate.

Ive been using duckdns and all my domains are in that list.
changeip = banned
freedns =banned
duckdns =honeypot
no-ip =honeypot

I think its safe to say that if your going to be doing anything criminal it might be a good idea to invest in some OPSEC and use your own DNS.
Think of it like a botnet do you use free hosting that can be banned/shutdown/reported easily.....NO
SO go the extra mile and buy a cheap vps to setup your own DNS

Here is an update client that works wit a large number of DynDNS providers.
http://www.directupdate.net/

Spoiler (Click to View)

🤝

LSDoom · Jul 22, 2015 09:55 AM

Thanks for sharing this. Will definitely get rid of my DuckDNS account and client.

QU⚡CKSILVER · Jul 22, 2015 10:08 AM

Thanks for the feedback regarding their Honeynet project for analyzing new threats. PEOPLE BE AWARE, don't use this shit ever again! This situation reminds me of what happened with NoIP...

Dang it! I had put my trust in DuckDNS for over a year, but now they've just gone bitchy

professoraegon · Jul 22, 2015 10:22 AM

Thanks for the heads up. Thats too bad as duckdns was really working great. Any suggestions on where we should be migrating?

LSDoom · Jul 22, 2015 10:24 AM

(Jul 22, 2015 10:22 AM)professoraegon Wrote: Thanks for the heads up. Thats too bad as duckdns was really working great. Any suggestions on where we should be migrating?

I see a lot of people are using FreeDNS. I have no personal experience with that service though. Stay away from NO-IP, that's all I got to say.

Armada · Jul 22, 2015 02:02 PM

Users who utilize RA4WVPN services, I have created some DNS pointers for use.

// Click Here to View The Spreadsheet //

Hope this helps some users. 🤝

©Ratatouille™ · Jul 22, 2015 04:37 PM

mother fucker lost 1k http://mediafire.duckdns.org

No ip = Ban

DNS exit = Ban

DuckDns = Ban

Now go freedns

Eternal. · Jul 22, 2015 04:43 PM

Id use Free DNS instead. How to setup a Dynamic DNS – An Alternative to no-IP

๖ۣۜCyber · Jul 22, 2015 04:43 PM

Thanks for the new DNS' for RA4W personally I use it so xD

Thanks again

Minato Namikaze · Jul 22, 2015 04:47 PM

FreeDNS all the way, good thing I chose them along time ago ;)

Jul 22, 2015 04:58 PM

Goddamn you Armada. Stop being so goddamn helpful and HQ......

xchg · Jul 22, 2015 05:38 PM

Thanks for this man, will uninstall duckdns

SIM-1676753 · Jul 22, 2015 05:46 PM

Someone should make custom DNS server for HF.

Minato Namikaze · Jul 22, 2015 07:57 PM

(Jul 22, 2015 05:46 PM)SIM-1676753 Wrote: Someone should make custom DNS server for HF.

Wouldn't that be a bit, challenging?
I mean, ad revenue though lol

SIM-1676753 · Jul 22, 2015 08:49 PM

(Jul 22, 2015 07:57 PM)Minato Namikaze Wrote: Wouldn't that be a bit, challenging?
I mean, ad revenue though lol

Hmm.. Blackhat money? Jokes, lol.

Login
Username/Email:
Password:	Lost Password?
	Remember me

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
The Red Team Playbook: C2 & RAT Deployment with .bat and .vbs by CyberXeroSep 22, 2026 12:50 PM	6	187	Sep 22, 2026 12:50 PM Last Post: CyberXero
How to completely remove DuckDNS from Linux ? by D33PN3TFeb 28, 2021 03:06 PM	5	189	Feb 28, 2021 03:06 PM Last Post: D33PN3T
Java rat with simple deployment? by BlankStatementDec 5, 2020 10:12 AM	0	128	Dec 5, 2020 10:12 AM Last Post: BlankStatement