Forest Global Training Partners

Cyber Risks · Krebs on Security

Who’s Behind the “Reopen” Domain Surge?

Summary: KrebsOnSecurity found roughly 150 domains registered in the past month beginning with "reopen" and ending in .com, many naming U.S. states and cities, with more than 50 registered within an hour on April 17 between 3:25 p.m. and 4:43 p.m. ET, the same day President Trump tweeted that citizens should "liberate" their states. Registration records and shared Google Analytics code UA-60996284 tied many of the sites to gun rights groups, state Republican Party organizations, and conservative groups including FreedomWorks and In Pursuit of LLC, while a name in some records, Michael Murphy, was later disputed by Murphy, who told Jacksonville.com he did not register reopenmn.com or reopenpa.com.

Bottom line: The campaign shows how cheap domain registration plus obscured WHOIS records and shared tracking codes can make an orchestrated effort look like grassroots demand, and the reporting itself needed a correction when the registrant data proved unreliable.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related