A Stealer Registered My Name as Its C2. Our Own Feed Hesitated to Block It.
Yesterday, while we were loading Gen Threat Labs' list of Warden Stealer command-and-control domains into our feed, the job stopped on one of them and asked me a question: is patduggan[.]com yours? It isn't. I have never owned it. Somebody registered it on October 3, and within five days it was wired into builds of an infostealer that steals AI coding-agent tokens. As of this morning it is in our feed's domain blocklist at confidence 80, under my own name's spelling. Here is the whole story, and the one useful lesson in it.
What the records say
Registered: October 3, 2026 at 22:26 UTC, at NameSilo, for one year. It was 16 days old when we found it.
Registrant: hidden behind PrivacyGuardian, the registrar's privacy service. No name, no country we can see.
Nameservers: Cloudflare, set at registration and never changed.
October 8: Gen Threat Labs publishes its Warden Stealer analysis. The domain is in their list of C2 domains extracted from the stealer's build configurations.
October 13: ThreatFox researcher Myrtus0x0 reports the site as a C2 for an unnamed stealer.
October 16: it enters our feed through ThreatFox at confidence 70. Our domain file doesn't filter on confidence, so every default subscriber already got it from that day.
Today: Cloudflare's nameservers refuse to answer for it and public resolvers return SERVFAIL. Either the operator deleted the zone or Cloudflare removed it; we can't tell which from outside. The registration itself is paid up until October 2027, so it can come back on new nameservers any day. The Internet Archive was offline when we checked, so we don't know whether the name had an earlier life before this registration.
Was it aimed at us?
Probably not, but we can't prove it either way. Gen's list has 256 domains, and a lot of them are throwaway people's names: john-jones[.]club, lily-philips[.]club, maryafuller[.]com, vlad-nazarenko[.]club, ilya-shabalin[.]club. Warden's operators clearly pick human-looking names, and "pat duggan" is a common enough one. The things that keep the other reading open are that it is my exact handle, it is a .com, and it showed up while we were publishing about stealers and AI-agent tokens. Nothing in the records links it to us beyond the string.
The lesson: the hesitation is the attack surface
Here is the part worth your time. Our pipeline did the right thing: a C2 domain that matches the name of the person who runs the feed should never be blocked automatically, because the cheapest way to embarrass a blocklist is to get its owner's own infrastructure onto it. So the job held it out and asked.
But look at what that check costs. For a day, a live stealer C2 stayed at 70 instead of 80, because it looked like it might be ours. Default subscribers were covered anyway, but anyone who filters our feed at 80, the line we block at ourselves, was not. If you run an allowlist, a "don't block our own brand" rule, or a reviewer who hesitates at a familiar name, a domain that looks like yours buys an attacker exactly that delay. Intended or not, this one did.
What we'd suggest, and what we did:
Keep the check. Never auto-block something that might be your own infrastructure.
Make the check fast and factual, not a judgement call. Look up the registration date and registrar in RDAP. Your real domains are years old and registered to you; this one was 16 days old and behind a privacy service. That answer takes ten seconds.
Once it's ruled out, block it at full confidence, and write down in the record why it was held, so the next person doesn't hesitate again.
If you see your own name in a C2 list, the same applies. Check the registration before you assume anything, in either direction.
The free key that pulls the feed, my own name included, is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=stealer-registered-my-name
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=a-stealer-registered-my-name-as-its-c2-our-own-feed-hesitated-to-block-it
Comments