FBI seizes StarkRDP(and possibly RDP.sh)

zGato

Levi

@zGato said:

He is annoying. I like more calm personalities, less posh.

wadhah

@alifya said:

@Ziny said:

@kait said:

Today, the FBI also seized the domains used by:

MySellIX (mysellix.io) and SellIX (sellix.io), two platforms that allowed users to create their own online stores, which threat actors also used to sell stolen data, software keys, and compromised accounts, and
StarkRDP (starkrdp.io), a Windows RDP virtual hosting provider that some threat actors allegedly used for credential stuffing attacks.

https://www.bleepingcomputer.com/news/security/fbi-seizes-domains-for-crackedio-nulledto-hacking-forums/ (archive)

cross-post via LES

StarkRDP and Sellix was operated by the same group of Germans as RDP.sh who I suspect is next to go.

https://bgp.tools/as/210558 is the network of RDP.sh

Imprints all pointing to Florian Marzahl/1337 Services GmbH

StarkRDP (archive)

RDP.sh (archive)

LinkedIn with Sellix (archive)

cross-post via LES

Nulled.to and Cracked.io are all down as well, I just purchase a membership on nulled too

Same as me. I also bought a membership from nulled.
I'm sure they will create forums with other domains in the near future.

I'm sure it's not you that bought the membership and it's definetly your friend, so what does your friend gain from the membership? Like a VIP tag in the forums?

concept

Starkrdp posted this on discord.

arnoldz

@concept said:
Starkrdp posted this on discord.

Oh wow, who’s behind this kind of mess? Could it be the Russian security services, like the KGB & Vlad Putin?

subasrikiat238

How is it even legal to seize (steal) domains like that, on what grounds? What are hosting providers supposed to do in such situations? Slippery slope, isn't it?

Ziny

@wadhah said:

@alifya said:

@Ziny said:

@kait said:

Today, the FBI also seized the domains used by:

MySellIX (mysellix.io) and SellIX (sellix.io), two platforms that allowed users to create their own online stores, which threat actors also used to sell stolen data, software keys, and compromised accounts, and
StarkRDP (starkrdp.io), a Windows RDP virtual hosting provider that some threat actors allegedly used for credential stuffing attacks.

https://www.bleepingcomputer.com/news/security/fbi-seizes-domains-for-crackedio-nulledto-hacking-forums/ (archive)

cross-post via LES

StarkRDP and Sellix was operated by the same group of Germans as RDP.sh who I suspect is next to go.

https://bgp.tools/as/210558 is the network of RDP.sh

Imprints all pointing to Florian Marzahl/1337 Services GmbH

StarkRDP (archive)

RDP.sh (archive)

LinkedIn with Sellix (archive)

cross-post via LES

Nulled.to and Cracked.io are all down as well, I just purchase a membership on nulled too

Same as me. I also bought a membership from nulled.
I'm sure they will create forums with other domains in the near future.

I'm sure it's not you that bought the membership and it's definetly your friend, so what does your friend gain from the membership? Like a VIP tag in the forums?

You are able to advertise, conversate in any of the sub-forums, high rep, some cool tags and thats it lol

sillycat

@subasrikiat238 said: How is it even legal to seize (steal) domains like that

With a court issued order, ofc.

@subasrikiat238 said: What are hosting providers supposed to do in such situations?

Fight it in court.

Levi

Europol writing:

https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-takes-down-two-largest-cybercrime-forums-in-world

Breath mention of case by the krebsy:

https://krebsonsecurity.com/2025/01/fbi-dutch-police-disrupt-manipulaters-phishing-gang/

HostSlick

https://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-nulled/

sillycat

StarkRDP has already rebranded to LakeVPS.

https://x.com/vxdb/status/1886938553424199907
https://client.lakevps.io/announcements/2/StarkRDP-is-now-called-LakeVPS.html

sandoz

WeHost.gg something also allegedly happened after this event.