Springz

NIKKE PC launcher incident: calm progress update, with real good news. 🙂 ✅ What's done • Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS). • Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry). • 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped. 🟢 What's good • The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain. • So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful. • Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow. 🔜 What to expect next • The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most. • If the domain gets suspended, I'll confirm it in DNS and registry data before saying so. • Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands. Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first. No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better. Credit: MotherSphere's report and everyone who checked and shared evidence. Guide with checks, steps and sources: - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

NIKKE PC launcher incident: the attacker's domain is DOWN. Real good news, and a win for all of us. 🎉 ✅ What's done • The registrar (PublicDomainRegistry) suspended insightjs[.]com, the attacker's domain. I checked it myself in registry and DNS data: a hold since Nov 5, 02:05 GMT, the name servers were swapped, and the name no longer resolves. • The registrar confirmed by email that it reviewed my abuse report and suspended the domain, about five hours after I sent it. The email is in the picture, cropped. • The host (1984 ehf) says it shut down the server I reported. 🟢 What it means • The address the infected scripts loaded the malware from is gone. In theory, the old attack now has no known address left to load from or send data to. • That helps everyone who hasn't launched the PC launcher yet: the publisher says the current version is safe, and now the attacker's known address is dead too. I'm not telling anyone to rush, so follow the publisher's guidance first. • It does not clean a PC that already ran the infected launcher. If that's you, use the official manual check: teapawt.org/NIKKE_en/status/211811… ➡️ What to expect next • A hold can be lifted, and the attacker can try a new domain or server. The same kind of report works again, and I'll keep watching. • Not everything is closed yet: I'm still waiting on the host about the rest. • Law enforcement is a possible next step. I'll ask the registrar and the host to keep their records for investigators. To the NIKKE team (@NIKKE_en): what I just did, you should have done yourselves from the very start. It was easy: one clear report, about five hours. It only takes speed, and every hour counts for players. Please keep moving fast: report the rest of the infrastructure, tell us if the police are involved, and keep players informed. Thank you for the official scan and guide. Thank you all for the shares, the evidence and the calm. 🙏 Guide with checks, steps and sources: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Nobody can tell that from the log alone, and the publisher says the scope is still being investigated. With no registry entry or DLL, those steps are done. Do the rest: antivirus full scan plus Offline Scan, and new passwords and API keys from another device: teapawt.org/NIKKE_en/status/211811…

The publisher doesn't ask for a Windows reinstall. After the cleanup its remaining steps are an antivirus full scan plus Windows Security Offline Scan, and new passwords and API keys. If something odd continues, contact Customer Support.

Fair question. The tracing uses public records anyone can check: RIPE for the IP owner, DNS lookups, domain registry data. Steps are in ANALYSIS.md, row 31: github.com/SpringZali/nikke-… The guidance parts come from Level Infinite's official posts.

Reinstalling won't bring the old log back, so that check is gone. The official guide also covers the registry entry, the Chrome DLL folder and tbs_cache: teapawt.org/NIKKE_en/status/211811… Our suggestion: check those, then run the antivirus scans. The current launcher is called safe.

The red step was wording from an older version of my guide. Use the publisher's manual steps now: teapawt.org/NIKKE_en/status/211811… (registry entry, restart, Chrome DLL folder, tinyget file, tbs_cache, then scans and new passwords). I haven't seen an official video.

Los registros muestran servidores virtuales alquilados (VPS) en 1984 ehf, Islandia, no una VPN. Eso indica dónde se alquilan, no quién los usa, y eso no se sabe. Detalles (fila 31): github.com/SpringZali/nikke-…

A good sign, but the publisher says not finding the string is not a complete all-clear. Also follow its steps (teapawt.org/NIKKE_en/status/211811… ), run the antivirus full scan plus Windows Security Offline Scan, and change passwords and API keys from another device.

The official notices only describe the NIKKE PC launcher. I haven't seen anything from the publisher about other games.

Follow the publisher's removal steps: teapawt.org/NIKKE_en/status/211811… registry entry (then restart), Chrome DLL folder if it exists, tinyget file, tbs_cache. Then revoke API keys and tokens, run the full scan plus Offline Scan, and contact Customer Support if anything odd continues.

Level Infinite says the current launcher version is safe to use, and our checks agree the official files are clean. If you ran it after Sep 27, check first (teapawt.org/NIKKE_en/status/211811… ) and change passwords. Waiting is also fine.

Not a dumb question. The publisher doesn't ask for a Windows reinstall or upgrade. Its steps are removal of the listed items, antivirus scans, and new passwords and API keys: teapawt.org/NIKKE_en/status/211811…

Fair point: an older version of my guide mentioned a clean install. The publisher doesn't ask for one. With k2f in your log, follow its removal steps: teapawt.org/NIKKE_en/status/211811… then the antivirus scans and new passwords and API keys.

Sorry, that's stressful. The official steps are clear: remove the registry entry and the Chrome DLL folder, delete the tinyget file and tbs_cache, run the antivirus scans, and change passwords and API keys from another device: teapawt.org/NIKKE_en/status/211811…

An antivirus quarantine is fine as part of the scan step, but it doesn't replace the publisher's manual steps: registry entry, Chrome DLL folder, tinyget file, tbs_cache, then a full scan plus Offline Scan and new passwords and API keys: teapawt.org/NIKKE_en/status/211811…

Level Infinite says the current launcher version is safe to use, and our checks agree the official files are clean. If you ran it after Sep 27, check first (official scan or manual guide: teapawt.org/NIKKE_en/status/211811… ) and change passwords.

A sensible start. The publisher also asks everyone who ran the launcher after Sep 27 to change passwords from another device, revoke API keys and tokens, and finish with a full scan plus Windows Security Offline Scan: teapawt.org/NIKKE_en/status/211811…

Level Infinite calls the current launcher version safe to use. If you ran it after Sep 27, check first as in the official guide: teapawt.org/NIKKE_en/status/211811… Uninstalling alone isn't a cleanup, because those items sit outside the launcher folder.

The publisher doesn't ask for a fresh install, so I can't give official guidance on backups. Its steps target specific items (registry entry, Chrome DLL folder, tinyget file, tbs_cache) plus scans and new passwords: teapawt.org/NIKKE_en/status/211811…

An antivirus quarantine is fine as part of the scan step, but it doesn't replace the publisher's manual steps: registry entry, Chrome DLL folder, tinyget file, tbs_cache, then a full scan plus Offline Scan and new passwords and API keys: teapawt.org/NIKKE_en/status/211811…