[EbonCipher]

So i tried my rat on my cousin and all of sudden 2 people from the US appeared? I couldn't do anything, but they were just there, and after 1-2 mins they disappear again?. What the actual fuck?. lmao.

[IHasBrains]

Maybe honeypots. If you can, uninstall them. Leave them alone if you can't.

[Bad C0d3]

Maybe some online sandbox service

[Yetiii]

Previous clients/Slaves? Maybe the RAT you are using is unstable

[Leeway]

I am guessing they are honey pots I would also suggest uninstalling them.

[Esme]

I'd say just uninstall them. Where have you been scanning?

[ze-slade]

Have you only spread your rat to your cousin?

[kəˈrɪzmə]

Why would you want to RAT family lol?

What DNS are u using?

Check out my sig for a good spreading method

[EbonCipher]

Why would you want to RAT family lol?

What DNS are u using?

Check out my sig for a good spreading method

testing it on my cousin. I asked for permission before i did anything.

using duckdns

[Armada]

Firstly stay away from Duck DNS.
They are Known to Honey Pot our Binaries now. SEE THIS THREAD FOR INFO

But in relation to your question, if both of the clients appeared identical some rats are known to Double log clients in to the console, one of them could have simply been a shadow\ghost connection to the original.

Otherwise it is likely DuckDNS's Honeypot analyzing your binary and reporting it to AV vendors.🤝

[Strayta]

Don't use duckdns man. That is probably why you got 2 more

[EbonCipher]

Don't use duckdns man. That is probably why you got 2 more

Which one do you prefer?.