Springz

NIKKE PC launcher incident: the attacker's domain is DOWN. Real good news, and a win for all of us. 🎉 ✅ What's done • The registrar (PublicDomainRegistry) suspended insightjs[.]com, the attacker's domain. I checked it myself in registry and DNS data: a hold since Nov 5, 02:05 GMT, the name servers were swapped, and the name no longer resolves. • The registrar confirmed by email that it reviewed my abuse report and suspended the domain, about five hours after I sent it. The email is in the picture, cropped. • The host (1984 ehf) says it shut down the server I reported. 🟢 What it means • The address the infected scripts loaded the malware from is gone. In theory, the old attack now has no known address left to load from or send data to. • That helps everyone who hasn't launched the PC launcher yet: the publisher says the current version is safe, and now the attacker's known address is dead too. I'm not telling anyone to rush, so follow the publisher's guidance first. • It does not clean a PC that already ran the infected launcher. If that's you, use the official manual check: teapawt.net/NIKKE_en/status/211811… ➡️ What to expect next • A hold can be lifted, and the attacker can try a new domain or server. The same kind of report works again, and I'll keep watching. • Not everything is closed yet: I'm still waiting on the host about the rest. • Law enforcement is a possible next step. I'll ask the registrar and the host to keep their records for investigators. To the NIKKE team (@NIKKE_en): what I just did, you should have done yourselves from the very start. It was easy: one clear report, about five hours. It only takes speed, and every hour counts for players. Please keep moving fast: report the rest of the infrastructure, tell us if the police are involved, and keep players informed. Thank you for the official scan and guide. Thank you all for the shares, the evidence and the calm. 🙏 Guide with checks, steps and sources: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Big news in the NIKKE PC launcher incident: official guidance is out. 🙂 Level Infinite (NIKKE's publisher) just posted an apology and a follow-up notice. Here is what it says, and what it means for you. ✅ What's confirmed • A third party tampered with PC launcher files, and PCs and account data may have been exposed. The scope is still being investigated. • The publisher says the current launcher version is safe to use. Our own checks agree: the official CDN files are clean. • From Nov 5, 08:00 JST (Nov 4, 23:00 GMT) the official PC client scans for the malware and offers to remove it. Close Chrome and other browsers first. • Change the passwords of accounts used on that PC, and revoke API keys and tokens. Compensation is announced, and Customer Support handles losses. 🔍 My tip The official scan deletes what it finds. If you want to keep your evidence, copy Launcher\intl_service\debug.log first (search it for k2f_chan), then run the scan. That's my suggestion, not an official step. Don't wipe or uninstall before checking. 🔜 Still open Scope of the damage, how the CDN was reached, and the manual check guide the publisher promised. The attacker's domain is not suspended yet: my reports are with the host and the registrar. I'll update the guide and say so here when anything changes. Guide with checks, steps and a summary of the official notice: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

NIKKE PC launcher incident: calm progress update, with real good news. 🙂 ✅ What's done • Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS). • Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry). • 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped. 🟢 What's good • The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain. • So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful. • Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow. 🔜 What to expect next • The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most. • If the domain gets suspended, I'll confirm it in DNS and registry data before saying so. • Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands. Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first. No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better. Credit: MotherSphere's report and everyone who checked and shared evidence. Guide with checks, steps and sources: - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

NIKKE launcher update: the attacker's server was a rented VPS at 1984 ehf (Iceland), not a VPN. It was reportedly shut down on Nov 3, but the domain's DNS is still hosted there, so I'm sending an abuse report. Please don't spam or harass anyone: a host isn't the attacker.

A security warning inside the NIKKE launcher does NOT prove your PC was hacked. That warning comes from a page at insightjs[.]org that went up on Nov 3, after the incident was already public. The researcher's report says the page calls itself an independent notice. It shows up when the launcher's modified script can't reach the attacker's server. Block the attacker's address, or have their server go offline, and you see it. So the warning means one thing: the modified script loaded. That's exposure to the first stage, not proof the remote-control program ran. And no warning doesn't mean you're fine either. The real check is debug.log. Search it for k2f_chan before you uninstall or wipe anything. Calm. Check first. Then decide: github.com/SpringZali/nikke-…

A lot of people are panicking about the NIKKE PC launcher, so here's what I'd want someone to tell me. First, what's confirmed. SHIFT UP has acknowledged possible tampering, and the researcher's report (MotherSphere's) holds up everywhere I could check it. Second, exposed is not the same as infected. The attack code only reached some launches, and some people who checked found no sign of it. That's why checking matters. What I'd do right now: - Close the launcher and don't open it yet. - Don't uninstall or wipe before you check. Uninstalling deletes the evidence. - Search debug.log for k2f_chan. A hit means take the serious steps. No hit, or no log left? The guide has calm steps for that too. Staying calm and checking first is the right call. The guide has the 5-minute check, what each result means, and what's verified vs. not. Written with AI help, and every check is reproducible: github.com/SpringZali/nikke-… If someone you know is about to wipe their PC, send them this first. If anything here needs fixing, tell me and I'll update it in public.

UPDATE on the NIKKE PC launcher: a step forward. NIKKE's official account posted a notice. What it says: • They identified an anomaly indicating the launcher's script files may have been tampered with by a third party. • In response, they pushed client fixes and updates around 02:30 on Nov 4. • They're investigating the scope of impact and will share guidance in a separate notice. Credit where it's due: they acknowledged it, apologized, and shipped a fix. So my zero official confirmation post is now outdated. Facts changed, so here's my update. Still missing: what was accessed, who was affected, and what players should do. That's what the guidance notice is for, and they say it's coming. Personally, I'm re-downloading the launcher and getting back into the game now that the client fix is out. That's my own call, not an all-clear. If you'd rather wait for Shift Up's guidance first, that's a perfectly good choice, no judgment. Two simple rules meanwhile: no random "fixes" from strangers, and if your debug.log shows k2f_chan lines, change your passwords from a clean device. No panic. Just facts, and I'll keep updating.

Another user report, folks: the warning screen AND the k2f lines on their PC. I'm NOT hiding it. That's why I say PAUSE THE LAUNCHER. And he's right: Shift Up should post an official statement. NOW. Until then: stay calm, no random fixes. SAD!

Follow-up to the post above. IMPORTANT: please read before you do anything to your PC. 🚨 Shift Up still hasn't confirmed what's going on with the NIKKE PC launcher. Please pause the launcher and wait. That's all you need to do right now. Note on the post above: it's from earlier today, and the public analysis has since added reports from other victims, so the "one PC" line is outdated. One more reason to wait for the official word. But there's a second problem, and it's real 👇 Panic is being used against people. I'm hearing from people in the community, especially the Asian community, that scammers are already sharing suspicious GitHub links, "fixes" and "cleaners" to scared players. I can't verify every report, but it's a well-known trick, so be careful. Please: • Don't download or run anything you don't understand • Don't follow a guide step by step just because it's going around • If you're not sure what a step does, don't do it. Ask someone you trust first. You can ask me too • Simple checks, like opening a log file to read it, are fine. Deleting system files or running downloaded tools is where people get hurt • If you already ran something you're unsure about, disconnect from the internet and ask for help before doing anything else Two facts to hold on to: 1) Shift Up has not confirmed anything yet 2) Some people may end up infected by fake "fixes" installed in a panic, which makes it harder to tell what is actually going on I don't know how big this is, and nobody else does yet. Waiting costs you nothing. Running the wrong thing can cost you a lot. Pause the launcher. Stay calm. Wait for the official word. I'll update here the moment there's news. Repost so more people see this.

Everyone, let's slow down for a second. The Nikke PC "supply chain attack" has ZERO official confirmation. Not from Level Infinite. Not from Shift Up. Nothing. What it does have: one PC. A few screenshots. A string to search for in a log file. No malware sample. No file hashes. No technical proof anyone can verify. Panic spreads faster than facts. Don't be part of it. Here's what we actually know 👇