Castiell

NIKKE PC launcher incident: calm progress update, with real good news. 🙂 ✅ What's done • Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS). • Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry). • 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped. 🟢 What's good • The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain. • So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful. • Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow. 🔜 What to expect next • The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most. • If the domain gets suspended, I'll confirm it in DNS and registry data before saying so. • Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands. Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first. No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better. Credit: MotherSphere's report and everyone who checked and shared evidence. Guide with checks, steps and sources: - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… Follow me and star the repo to get updates.