/0

2210 readers

156 users here now

Meta community. Discuss about this lemmy instance or lemmy in general.

Service Uptime view

founded 3 years ago

MODERATORS

db0@lemmy.dbzer0.com

266

Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance (lemmy.nz)

submitted 2 days ago by empireOfLove2@lemmy.dbzer0.com to c/div0@lemmy.dbzer0.com

70 comments fedilink hide all child comments

FYI admins

cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

you are viewing a single comment's thread
view the rest of the comments

[–] OwOarchist@pawb.social 13 points 2 days ago (1 children)

I wonder if you could actually track him down and prosecute him for it...

[–] wiccan2@thelemmy.club 22 points 2 days ago (2 children)

The domain seems to be registered to SquareSpace so his details are hidden from public view but there is a SquareSpace abuse email and US phone number.

I suspect in the first instance if db0 complained to them the site would be shutdown and SquareSpace would then have to comply with any legal action.

INAL but I strongly suspect that the DDOS would constitute a crime in the US where the domain is registered.

[–] Taleya@aussie.zone 7 points 2 days ago (1 children)

Nah he's hosted on inmotion. I already bipped 'em

[–] wiccan2@thelemmy.club 11 points 2 days ago (2 children)

The domain is registered to SquareSpace: https://who.is/whois/dubvee.org

The IP associated with the domain points to Inmotion: https://who.is/whois-ip/ip-address/107.161.30.39

Looks like both are true, hopefully Inmotion will take appropriate action based on your report. Worthwhile reporting to SquareSpace too so he can't just rehost an attack elsewhere.

[–] Taleya@aussie.zone 17 points 2 days ago (1 children)

Registrar and hosting are different things.

Registrar is who you bought and manage the domain name you use on your site through. Hosting is where it lives.

Most domain name registrars do not give a single shit what you do with a domain name, unless they're somehow on the hook. Hosting on the other hand.....

[–] wiccan2@thelemmy.club 6 points 2 days ago

I understand how it works.

All I'm saying is the registrar should also be notified otherwise the site can be moved to another hosting platform.

If the registrar can be convinced to take action, at least the domain can't be used for future attacks.

[–] Draconic_NEO@lemmy.dbzer0.com 4 points 1 day ago

Check startrek.website too. They defederated us immediately after banning someone who claimed to be an alt of Admiral Patrick. If their domain is less protected we might be able to bring him to justice over this.

[–] SpikesOtherDog@ani.social 7 points 2 days ago

Yup. Anyone knowingly assisting would also be implicated. Afaik, the precedent was set about 20 years ago with the whole LOIC/anonymous ddos.