Backdoor sinkhole

A backdoored FiveM resource calls out to a drop point to report your server, leak your keys, or take commands. The panel gives you the list of known drop points as a hosts file. You apply that file on the machine that runs your server, and from then on those names resolve to nowhere.

The Backdoors tab only appears when the server has an active FiveM inbound rule, because on any other box the list means nothing. If you do not see the tab, add a rule for FiveM first, either by hand on Port rules or with the FiveM preset. The download is gated by the same check, so there is no separate URL to reach it.

What this is

It is a text file of hostnames, each pointed at 127.0.0.1, that you append to your own system hosts file. After that, any resource on that machine asking for one of those names gets your own loopback address instead of the drop point, and the call goes nowhere.

That is the whole mechanism, and it is worth being precise about where it runs.

• It runs on your machine, not at the Clouduxe edge. Downloading the file changes nothing on its own. Nothing takes effect until you apply it on the server.
• Clouduxe does not inspect your outbound traffic. There is no report of attempted callbacks, no alert, and no way for support to tell you whether a resource of yours tried to phone home. The only signal you get is your own.
• It matches names, not addresses. A backdoor that has an IP address hardcoded into it never performs a lookup, so the hosts file never sees it and never stops it.
• It is a snapshot of the hosts known today. A backdoor pointed at a domain nobody has reported yet passes straight through.

Applying it

Pick Linux or Windows on the tab first. The two downloads are not the same file: the Windows build uses Windows line endings so it stays readable in Notepad.

1. Download the file, then copy it onto your server

   Use the Download for Linux or Download for Windows button. The download is tied to your panel session, so fetching it from the server itself with curl will not work. Download it in your browser, then upload it with SFTP or your file manager. See Connecting to your server if you need the address and credentials.

2. Append it to the system hosts file

   On Linux, from the directory you uploaded it to:

   ShellCopy

   sudo tee -a /etc/hosts < clouduxe-backdoor-hosts-linux.txt

   On Windows, in PowerShell as Administrator, from the folder you uploaded it to:

   PowerShellCopy

   Get-Content .\clouduxe-backdoor-hosts-windows.txt | Add-Content -Encoding ASCII $env:SystemRoot\System32\drivers\etc\hosts

   Both append to the system hosts file, /etc/hosts on Linux and C:\Windows\System32\drivers\etc\hosts on Windows. The downloaded file starts with a blank line, so appending is safe even if your hosts file has no trailing newline.

3. Check it took effect

   On Linux:

   ShellCopy

   getent hosts 5mscripts.net

   On Windows:

   PowerShellCopy

   Resolve-DnsName 5mscripts.net -CacheOnly

   Either should answer 127.0.0.1. On Windows, run ipconfig /flushdns first if the name is already cached. No restart is needed; new lookups pick the change up immediately.

4. Then go and find the resource

   Blocking the callback stops the damage. It does not remove the backdoor, which is still installed on the server. Audit what you have installed, especially anything leaked or bought outside the official store.

Keeping it current

The file is built at the moment you download it, so a later download includes anything added to the list since. Applying it again appends the newer copy to your hosts file. Repeated entries are harmless, because a name pointed at 127.0.0.1 twice still resolves to 127.0.0.1.

A domain nobody has reported yet is not on the list, so downloading the file again is not a substitute for auditing what you run.

Related