Home / News I have a News Tip

An Investigation Shows How Bomb Threat Scammers Hijacked Thousands of Big-Name Domains

The threatening emails sent on December 13 caused mass evacuations, closures, and lockdowns in the US, Canada, and other countries around the world. The emails threatened to blow up buildings and schools unless recipients paid a $20,000 ransom. Ars Technica's Dan Goodin reports that an "investigation shows the spam run worked by abusing a weakness at GoDaddy that allowed the scammers to hijack at least 78 domains belonging to Expedia, Mozilla, Yelp, and other legitimate people or organizations."

Analysis of historical Internet records by Researcher Ronald Guilmette lead him to believe that the stolen domain names were *not* simply ones that some bad actor has put entirely fraudulent WHOIS data in for. Goodin writes: "After noticing that virtually all of the affected domains were receiving domain-resolution service from GoDaddy prior to being hijacked, Guilmette theorized that a system-wide vulnerability was somehow involved."

Godaddy has since issued a response confirming that threat actor(s) abused our DNS setup process. "We've identified a fix and are taking corrective action immediately."

Follow CircleID on

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

To post comments, please login or create an account.



DNS Security

Sponsored byAfilias

IP Addressing

Sponsored byAvenue4 LLC


Sponsored byWhoisXML API

New TLDs

Sponsored byAfilias


Sponsored byThreat Intelligence Platform

Domain Names

Sponsored byVerisign


Sponsored byVerisign