Springz

NIKKE PC launcher incident: the attacker's domain is DOWN. Real good news, and a win for all of us. 🎉 ✅ What's done • The registrar (PublicDomainRegistry) suspended insightjs[.]com, the attacker's domain. I checked it myself in registry and DNS data: a hold since Nov 5, 02:05 GMT, the name servers were swapped, and the name no longer resolves. • The registrar confirmed by email that it reviewed my abuse report and suspended the domain, about five hours after I sent it. The email is in the picture, cropped. • The host (1984 ehf) says it shut down the server I reported. 🟢 What it means • The address the infected scripts loaded the malware from is gone. In theory, the old attack now has no known address left to load from or send data to. • That helps everyone who hasn't launched the PC launcher yet: the publisher says the current version is safe, and now the attacker's known address is dead too. I'm not telling anyone to rush, so follow the publisher's guidance first. • It does not clean a PC that already ran the infected launcher. If that's you, use the official manual check: teapawt.org/NIKKE_en/status/211811… ➡️ What to expect next • A hold can be lifted, and the attacker can try a new domain or server. The same kind of report works again, and I'll keep watching. • Not everything is closed yet: I'm still waiting on the host about the rest. • Law enforcement is a possible next step. I'll ask the registrar and the host to keep their records for investigators. To the NIKKE team (@NIKKE_en): what I just did, you should have done yourselves from the very start. It was easy: one clear report, about five hours. It only takes speed, and every hour counts for players. Please keep moving fast: report the rest of the infrastructure, tell us if the police are involved, and keep players informed. Thank you for the official scan and guide. Thank you all for the shares, the evidence and the calm. 🙏 Guide with checks, steps and sources: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Big news in the NIKKE PC launcher incident: official guidance is out. 🙂 Level Infinite (NIKKE's publisher) just posted an apology and a follow-up notice. Here is what it says, and what it means for you. ✅ What's confirmed • A third party tampered with PC launcher files, and PCs and account data may have been exposed. The scope is still being investigated. • The publisher says the current launcher version is safe to use. Our own checks agree: the official CDN files are clean. • From Nov 5, 08:00 JST (Nov 4, 23:00 GMT) the official PC client scans for the malware and offers to remove it. Close Chrome and other browsers first. • Change the passwords of accounts used on that PC, and revoke API keys and tokens. Compensation is announced, and Customer Support handles losses. 🔍 My tip The official scan deletes what it finds. If you want to keep your evidence, copy Launcher\intl_service\debug.log first (search it for k2f_chan), then run the scan. That's my suggestion, not an official step. Don't wipe or uninstall before checking. 🔜 Still open Scope of the damage, how the CDN was reached, and the manual check guide the publisher promised. The attacker's domain is not suspended yet: my reports are with the host and the registrar. I'll update the guide and say so here when anything changes. Guide with checks, steps and a summary of the official notice: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

NIKKE PC launcher incident: calm progress update, with real good news. 🙂 ✅ What's done • Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS). • Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry). • 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped. 🟢 What's good • The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain. • So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful. • Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow. 🔜 What to expect next • The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most. • If the domain gets suspended, I'll confirm it in DNS and registry data before saying so. • Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands. Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first. No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better. Credit: MotherSphere's report and everyone who checked and shared evidence. Guide with checks, steps and sources: - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Midterms are mostly in the books and a lot changed. I'm not cheering and I'm not panicking. My rule: judge the person, not the jersey. I'll watch what the winners actually do. Thread on why I'm curious about Texas.

@ChristopherXCIV @Vlakard

@Vlakard @LunariaTheIdol