Fur Affinity access restored after domain nameserver hijack

"Fur Affinity is now online and may be accessed safely", according to a journal on the now-accessible furry art community, recounting details of the hack that preoccupied much of the fandom for the best part of two days - and urging users to leave the FBI to investigate rather than pursue vigilante justice.

Meanwhile, the "Honoring Dragoneer's Legacy" fund approaches $200,000 - including five-figure donations by Paw Maltz and Bad Dragon - although there is still some way to go to the $221,800 target.

How Fur Affinity was hacked

Per Fur Affinity staff, the site's nameserver configuration was first changed by the "bad actor" at 12:47am Eastern on Tuesday 20 August 2024; their control lasted until 2:28pm the next day, with an server set to capture @furaffinity.net mail, including that of its recently-deceased leader.

Twitter user Hakopla1 provided a breakdown of events (unrolled). In short…

• A hacker exploited a DNS account vulnerability and then redirected the domain to a fake website trying to steal Fur Affinity user credentials
• When users got wind of it via discord, for a brief period, the domain redirected to the FA shop* (which many users thought was a fake site)
• Then it redirected to random websites like the X account* or a Washington Post story about furries abusing a kid
• Later it would redirect to the furry-focused "Animal Control" forum of Kiwi Farms, prompting its owner to make an official statement claiming that they had nothing to do with any of it and then disable new account registration.
• Finally, the domain was liberated from the hacker, showing a maintenance page until FA returned.

Marked with an asterisk * are what I personally saw during the hack left unmentioned on the thread.

The hacking didn't end there

Allegedly, the hacker used control of the mail server and X's password reset function to get ahold of the official FA account and Dragoneer's account.

When the hacker stole Fur Affinity's account, they promoted NFTs and crypto scams before going mask off and posting anti-furry content. They changed the @ to "ilovekiwi4lunch" in reference to Kiwi Farms, with FA user Whanos quickly renaming their account to @Furaffinity - promising to give it back to the rightful owners. The hacker asked folks to report Whanos, who reportedly "[received] ~3000 notifications" within eight hours".