Springz

NIKKE PC LAUNCHER INCIDENT: PHASE 2 Loss reporting and coordinated response. Community update, Nov 5, 2026. Phase 1 (containment) is complete: clean files are back on the CDN, the launcher has been updated with an official scan, and the attacker's domain has been suspended by its registrar. Thank you to everyone who checked, shared and stayed calm. Where things stand. The publisher's Nov 4 notices announced in-game compensation and referred real losses to Customer Support. I have seen no further update since then on the scope of the incident or on how real losses will be handled. Phase 2 covers: 1. one verified evidence package for the publisher, regulators and law enforcement 2. loss reporting through the proper channels, country by country 3. a formal, documented request to the publisher on scope and real losses 4. one source of verified facts, with confirmed and reported information kept apart How the work is organised. A closed working channel is being formed with security analysts, legal and data-protection specialists, regional community leads across Asia and beyond, and press. Participation is by direct invitation, to keep the group small and the work focused. Credit stays with the author of each finding. Other players do not need to sign up for anything. If you have suffered a real loss: • report it to the in-game Customer Support • keep your evidence: logs, screenshots, dates, account alerts • if money or accounts are gone, also report to your local police or cybercrime unit • you may leave a short comment here (country, platform, type of loss) and I may follow up by DM • never share passwords, keys or ID documents. I only send DMs from this account No promises on outcomes. Updates will be published here. Guide and sources: github.com/SpringZali/nikke-…

Me and my team will be working our best to cooperate with professionals, and save you from any possible losses or damages, keep updated if anything happens, stay strong.

NIKKE PC launcher incident: the attacker's domain is DOWN. Real good news, and a win for all of us. 🎉 ✅ What's done • The registrar (PublicDomainRegistry) suspended insightjs[.]com, the attacker's domain. I checked it myself in registry and DNS data: a hold since Nov 5, 02:05 GMT, the name servers were swapped, and the name no longer resolves. • The registrar confirmed by email that it reviewed my abuse report and suspended the domain, about five hours after I sent it. The email is in the picture, cropped. • The host (1984 ehf) says it shut down the server I reported. 🟢 What it means • The address the infected scripts loaded the malware from is gone. In theory, the old attack now has no known address left to load from or send data to. • That helps everyone who hasn't launched the PC launcher yet: the publisher says the current version is safe, and now the attacker's known address is dead too. I'm not telling anyone to rush, so follow the publisher's guidance first. • It does not clean a PC that already ran the infected launcher. If that's you, use the official manual check: teapawt.net/NIKKE_en/status/211811… ➡️ What to expect next • A hold can be lifted, and the attacker can try a new domain or server. The same kind of report works again, and I'll keep watching. • Not everything is closed yet: I'm still waiting on the host about the rest. • Law enforcement is a possible next step. I'll ask the registrar and the host to keep their records for investigators. To the NIKKE team (@NIKKE_en): what I just did, you should have done yourselves from the very start. It was easy: one clear report, about five hours. It only takes speed, and every hour counts for players. Please keep moving fast: report the rest of the infrastructure, tell us if the police are involved, and keep players informed. Thank you for the official scan and guide. Thank you all for the shares, the evidence and the calm. 🙏 Guide with checks, steps and sources: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Big news in the NIKKE PC launcher incident: official guidance is out. 🙂 Level Infinite (NIKKE's publisher) just posted an apology and a follow-up notice. Here is what it says, and what it means for you. ✅ What's confirmed • A third party tampered with PC launcher files, and PCs and account data may have been exposed. The scope is still being investigated. • The publisher says the current launcher version is safe to use. Our own checks agree: the official CDN files are clean. • From Nov 5, 08:00 JST (Nov 4, 23:00 GMT) the official PC client scans for the malware and offers to remove it. Close Chrome and other browsers first. • Change the passwords of accounts used on that PC, and revoke API keys and tokens. Compensation is announced, and Customer Support handles losses. 🔍 My tip The official scan deletes what it finds. If you want to keep your evidence, copy Launcher\intl_service\debug.log first (search it for k2f_chan), then run the scan. That's my suggestion, not an official step. Don't wipe or uninstall before checking. 🔜 Still open Scope of the damage, how the CDN was reached, and the manual check guide the publisher promised. The attacker's domain is not suspended yet: my reports are with the host and the registrar. I'll update the guide and say so here when anything changes. Guide with checks, steps and a summary of the official notice: github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

NIKKE PC launcher incident: calm progress update, with real good news. 🙂 ✅ What's done • Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS). • Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry). • 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped. 🟢 What's good • The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain. • So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful. • Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow. 🔜 What to expect next • The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most. • If the domain gets suspended, I'll confirm it in DNS and registry data before saying so. • Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands. Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first. No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better. Credit: MotherSphere's report and everyone who checked and shared evidence. Guide with checks, steps and sources: - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… - github.com/SpringZali/nikke-… Follow me and star the repo to get updates.

Midterms are mostly in the books and a lot changed. I'm not cheering and I'm not panicking. My rule: judge the person, not the jersey. I'll watch what the winners actually do. Thread on why I'm curious about Texas.