Home / News

An Investigation Shows How Bomb Threat Scammers Hijacked Thousands of Big-Name Domains

The threatening emails sent on December 13 caused mass evacuations, closures, and lockdowns in the US, Canada, and other countries around the world. The emails threatened to blow up buildings and schools unless recipients paid a $20,000 ransom. Ars Technica's Dan Goodin reports that an "investigation shows the spam run worked by abusing a weakness at GoDaddy that allowed the scammers to hijack at least 78 domains belonging to Expedia, Mozilla, Yelp, and other legitimate people or organizations."

Analysis of historical Internet records by Researcher Ronald Guilmette lead him to believe that the stolen domain names were *not* simply ones that some bad actor has put entirely fraudulent WHOIS data in for. Goodin writes: "After noticing that virtually all of the affected domains were receiving domain-resolution service from GoDaddy prior to being hijacked, Guilmette theorized that a system-wide vulnerability was somehow involved."

Godaddy has since issued a response confirming that threat actor(s) abused our DNS setup process. "We've identified a fix and are taking corrective action immediately."

By CircleID Reporter – CircleID's internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us. Visit Page

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet


 Be the first to post a comment!

Add Your Comments

 To post your comments, please login or create an account.



Domain Names

Sponsored byVerisign

DNS Security

Sponsored byAfilias


Sponsored byVerisign


Sponsored byThreat Intelligence Platform

IP Addressing

Sponsored byIPv4.Global

New TLDs

Sponsored byAfilias

Brand Protection

Sponsored byAppdetex


Sponsored byWhoisXML API