Domains Used in RSA Attack Taunted U.S.
Summary: A US-CERT unclassified document listed domains used in the intrusion at RSA, including www usgoodluck .com, obama .servehttp .com and prc .dynamiclink .ddns .us, most of which traced back to dynamic DNS providers. Sam Norris of ChangeIP.com said he terminated all the listed accounts on March 18, that the prc domain's holder emailed asking for it back, and that 99 percent of logins to change IP addresses for these domains came from Chinese addresses.
Key Takeaway: The attackers routed their infrastructure through free dynamic DNS services, so killing an account only forces a re-route to another address - and the account holder's request to get the prc domain back suggests the takedown cut off communications the attackers still wanted.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026