Bomb Threat, Sextortion Spammers Abused Weakness at GoDaddy.com
Summary: Spam campaigns including a July 2018 sextortion scam and a December 13, 2018 bomb threat hoax that shut down schools, businesses and government buildings were sent through thousands of established, reputable domains hijacked via an authentication weakness at GoDaddy, the world's largest domain registrar. Researcher Ron Guilmette found that of the 4,000+ domains used in the bomb threat campaign, at least 3,500 traced back to Reg.ru and other Russian hosting firms, and GoDaddy confirmed a threat actor abused its DNS setup process to create DNS entries on dormant domains.
Bottom line: The hijacked names belonged to Fortune 500 and Fortune 1000 companies including Facebook, Oracle, Tesla, Capital One and Walgreens, and the same weakness that let spammers send from those trusted domains affects many other major providers - meaning your brand's dormant domains may already be someone else's delivery infrastructure.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026