Domain Apocalypse

A practical walk-through of five ways attackers take over domains in the real world—social engineering, registrar account compromise, DNS provider takeover, NS hijacks, and expired-domain reclamation—and controls that prevent, limit, or detect them.

A registrar/DNS‑operations perspective on the October 20, 2025 AWS incident, how DNS actually works, why this failure propagated so widely, and what resilient internet teams can do about it.

What actually happens if you lose access to the wallet that holds your tokenized domain — and the operational steps to reduce the chance of getting there in the first place. Backups, multisig, hardware wallets, social recovery, and the limits of what any platform can do.

In September 2015, Google Domains accepted a $12 order for google.com from former employee Sanmay Ved, then canceled it about a minute later. What the incident proves, what remains uncertain, and why the $6,006.13 bounty still matters for domain security.

On July 15, 2020, attackers phoned their way into Twitter, hijacked the verified accounts of Obama, Biden, Musk, Gates, Apple and Uber, and ran a Bitcoin doubling scam — netting about $118,000. A deep-dive on how control of an online identity was stolen, and what it teaches about owning a name.

In July 2024, a registrar migration from Google Domains to Squarespace turned weak default authentication into a mass attack surface. Attackers hijacked the domains of crypto and DeFi projects — Compound Finance, Celer Network, Pendle, Unstoppable Domains — and pointed them at wallet-drainer phishing sites. Here is how a "seamless" migration created hundreds of unlocked front doors, and what it teaches about registrar security and MFA.

In December 2021, attackers compromised BadgerDAO's Cloudflare account and injected one malicious script into its website front-end. The audited smart contracts were never touched — yet ~$120M walked out the door through wallet approvals users signed without knowing. A deep-dive on why the website is part of your security surface.

In September 2021, Bitcoin.org — the long-time informational home of Bitcoin run by the pseudonymous operator Cobra — displayed a fake "double your Bitcoin" giveaway before the site was pulled offline. Nameserver and WHOIS changes led observers to suspect DNS compromise, but the public root cause remained unconfirmed. Here is what the incident teaches about crypto-native sites depending on ordinary domain infrastructure.

In August 2022, Curve Finance's smart contracts were untouched — but attackers hijacked the curve.fi domain at its registrar, cloned the site, and drained roughly $570K from users. A deep-dive into the DNS attack on a DeFi front-end, and what it teaches about domain security.

In late 2018, Cisco Talos disclosed DNSpionage — a campaign later linked by researchers to Iranian interests that included malware and a separate DNS-redirection operation against government and company domains. In January 2019, CISA ordered federal agencies to audit and secure DNS infrastructure through Emergency Directive 19-01.

On October 21, 2016, a DDoS attack powered by the Mirai IoT botnet hit DNS provider Dyn in three waves, making Twitter, Netflix, Reddit, Spotify, GitHub, Airbnb, PayPal, and other services unreachable for many users — a Domain Mayday case study in DNS provider concentration.

In September 2017, attackers logged into Dutch security firm Fox-IT's third-party domain registrar, changed its DNS, fraudulently obtained a TLS certificate, and ran a 10-hour man-in-the-middle on client traffic — until Fox-IT caught it and published one of the most transparent post-mortems in the industry.

GoDaddy says hosting incidents disclosed between 2020 and 2022 were part of a multi-year threat campaign that exposed 1.2 million Managed WordPress customers and redirected some hosted websites. A close look at provider concentration risk — and at what the disclosures do not establish.

In late 2014, spear-phishing emails spoofing ICANN's domain harvested staff credentials and enabled administrative access to files in the Centralized Zone Data System. A close look at the copied gTLD zone data and user information that were exposed — and the critical IANA systems that were not affected.

On February 25, 2015, attackers changed Lenovo.com's nameserver and mail routing, sending visitors to a webcam slideshow and exposing some email traffic. Researchers attributed the incident to a Webnic compromise, but Webnic did not publicly confirm their reported exploit chain.

In January 2015, Lizard Squad hijacked the DNS of malaysiaairlines.com and replaced the airline site with a tuxedo-wearing lizard and the taunt "404 — Plane Not Found." No server was breached — the attackers simply changed where the domain pointed. A Domain Mayday deep-dive into how DNS became the airline's most exposed front door.

On April 24, 2018, attackers hijacked the internet routing for Amazon Route 53, poisoned DNS answers for myetherwallet.com, and served a phishing clone behind a self-signed certificate — draining roughly $150,000 in Ethereum. A Domain Mayday deep-dive into why DNS rides on a routing layer that trusts by default.

In January 2005, panix.com — the domain of New York's oldest commercial ISP — was fraudulently transferred through a reseller account opened with stolen credit-card details. ICANN's review found a failure to obtain express authorization, not a flaw introduced by the then-new transfer policy.

In late January 2021, perl.com — a decades-old home of the Perl programming community — was stolen via a registrar-level account compromise, transferred through China, pointed at a malware-linked IP, and listed for $190,000. Here is how it happened, how it was recovered, and what it teaches about registrar account security.

How "Sea Turtle," a state-sponsored campaign disclosed by Cisco Talos in 2019, hijacked DNS through registrars, registries, and DNS providers — redirecting governments, ministries, and energy firms to attacker servers, obtaining CA-signed and other certificates for interception, and breaching a national TLD registry.

In 1995 a con man named Stephen Cohen stole sex.com from rightful owner Gary Kremen with a single forged letter to Network Solutions. The years-long fight to win it back ended in a $65 million judgment, a fugitive in Mexico, and a landmark ruling that domains are property.

In September 2021 an anonymous contractor slipped their own wallet address into SushiSwap's MISO launchpad front-end via a malicious commit, diverting 864.8 ETH (~$3M) from the Jay Pegs Auto Mart auction. A Domain Mayday deep-dive on code supply chains, front-end trust, and what it teaches about verifiable ownership.

On August 27, 2013, the Syrian Electronic Army phished a Melbourne IT reseller, rewrote the DNS records for nytimes.com and Twitter's domains, and took the New York Times offline for hours. A deep dive into how a registrar-chain weak link became a newspaper's front-door failure — and what registry locks would have changed.