Domain Security & Recovery

Understand how domain and DNS hijacking happen, where control can be lost, and which protections address the common attack paths.

In March 1994 the Princeton Review took kaplan.com and asked for complaints about its rival. Press reports said arbitrators ordered it to give up the name, five years before UDRP existed.

In 1994 reporter Joshua Quittner registered mcdonalds.com to test big brands. The company got it back after agreeing to help a New York school.

A 17-year-old's design site, a $10 offer and a 25-page letter: how MikeRoweSoft.com tested trademark law, a personal name and public opinion.

MTV host Adam Curry registered mtv.com in 1993. By 1994 the network was suing him. The court record shows what happened, what no judge decided, and why the often-listed price has no firm source.

Uzi Nissan used his surname for a Raleigh computer business, and Nissan Computer registered nissan.com in 1994. Court records show how Nissan Motor's suit ran from 1999 to 2008, and how his estate won an order returning the domains after his death.

John Schnatter built SavePapaJohns.com to fight his board. The settlement never mentioned the site, and by late 2020 the registration had started over.

Court papers say one person owns WordPress.org. How that domain became leverage in the WP Engine and Automattic dispute, and what the record has settled so far.

Check a DKIM selector, inspect the public DNS key, and verify a received message. Separate key publication from a passing signature.

Inspect the actual DMARC TXT record, effective policy, reporting destination, and message alignment before trusting a checker result.

Test which DNS resolvers your browser exposes, compare VPN states, and investigate unexpected results without assuming every mismatch is a leak.

Understand an HTTPS 403 response, check visitor permissions, and help site operators locate the rejecting application, origin rule, or security layer.

Choose managed HTTPS or Certbot, validate domain control, install a Let’s Encrypt certificate, and test renewal without unsafe workarounds.

Check the right SPF domain, read its TXT record, inspect lookup limits, and test real message authentication before changing DNS.

Check the certificate your HTTPS service presents. Verify the hostname, validity dates, chain, and client trust without bypassing validation.

Learn what port 443 does, how TCP and HTTP/3 differ, and how visitors and site operators can diagnose HTTPS without broad firewall changes.

Use the exact Chrome error, compare devices and networks, and check the HTTPS endpoint without bypassing certificate verification.

Understand DMARC alignment, publish a monitoring record, review reports, and choose an email policy without breaking legitimate mail.

Understand the eMudhra CA key compromise, website impersonation risks, and the different protections from DNSSEC, DANE, CAA, and CT.

Get a free HTTPS certificate through managed hosting or an ACME client. Check domain validation, hostname coverage, deployment, and renewal.

Choose a managed certificate or Certbot workflow, validate the right hostnames, check HTTPS, and test renewal before relying on the installation.

Choose a TLS certificate by hostname coverage, identity requirements, hosting support, and renewal responsibility instead of a confusing product label.

Compare Cloudflare, Google Public DNS, and Quad9 by filtering, encrypted transport, network requirements, and reversible local testing.

Compare DoH and DoT ports, authentication, fallback, and privacy limits, then verify which DNS connection your device actually uses.

Compare domain privacy, proxy registration, and RDAP redaction, then check disclosure terms, contact forwarding, and account recovery.

Understand parent-side DNS glue, compare in-domain and sibling nameservers, and verify safe glue changes with parent and child queries.

Harden a registrar account with phishing-resistant login, recovery planning, limited access, transfer controls, and reliable renewal checks.

Renew a TLS certificate, preserve domain validation, automate deployment, and check the certificate that visitors actually receive.

Understand DNS propagation timing, check authoritative and cached answers, and diagnose TTL, negative caching, and nameserver delays.

Understand HTTPS encryption, certificate checks, and port 443. Learn what a secure connection proves and how visitors and operators should respond.

A source-backed history of the thirty-year arms race over email sender reputation—the open relays, botnets, image spam, snowshoe campaigns, warmup networks, and other tricks bulk senders used to look trustworthy, the named operators who ran them, and the year and mechanism by which each trick was detected and shut down.

How custody really works for onchain domains: wallets, multisig, seed-phrase risk, and recovering a tokenized domain after wallet loss.

The common domain-sale scams — fake escrow, fake buyers, overpayment chargebacks, transfer-before-payment — and the habits that keep your sales safe.

Where legitimate domaining ends and cybersquatting begins: the UDRP three-part test, the ACPA, reverse domain hijacking, and how to stay safe.

The legal landscape every domain flipper needs: trademark basics, UDRP and ACPA, escrow at closing, hijacking defense, and how to dodge sale scams.

In September 2015, Google Domains accepted a $12 order for google.com from former employee Sanmay Ved, then canceled it about a minute later. What the incident proves, what remains uncertain, and why the $6,006.13 bounty still matters for domain security.

On July 15, 2020, attackers phoned their way into Twitter, hijacked the verified accounts of Obama, Biden, Musk, Gates, Apple and Uber, and ran a Bitcoin doubling scam — netting about $118,000. A deep-dive on how control of an online identity was stolen, and what it teaches about owning a name.

In July 2024, a registrar migration from Google Domains to Squarespace turned weak default authentication into a mass attack surface. Attackers hijacked the domains of crypto and DeFi projects — Compound Finance, Celer Network, Pendle, Unstoppable Domains — and pointed them at wallet-drainer phishing sites. Here is how a "seamless" migration created hundreds of unlocked front doors, and what it teaches about registrar security and MFA.

In December 2021, attackers compromised BadgerDAO's Cloudflare account and injected one malicious script into its website front-end. The audited smart contracts were never touched — yet ~$120M walked out the door through wallet approvals users signed without knowing. A deep-dive on why the website is part of your security surface.

In September 2021, Bitcoin.org — the long-time informational home of Bitcoin run by the pseudonymous operator Cobra — displayed a fake "double your Bitcoin" giveaway before the site was pulled offline. Nameserver and WHOIS changes led observers to suspect DNS compromise, but the public root cause remained unconfirmed. Here is what the incident teaches about crypto-native sites depending on ordinary domain infrastructure.

In August 2022, Curve Finance's smart contracts were untouched — but attackers hijacked the curve.fi domain at its registrar, cloned the site, and drained roughly $570K from users. A deep-dive into the DNS attack on a DeFi front-end, and what it teaches about domain security.

In late 2018, Cisco Talos disclosed DNSpionage — a campaign later linked by researchers to Iranian interests that included malware and a separate DNS-redirection operation against government and company domains. In January 2019, CISA ordered federal agencies to audit and secure DNS infrastructure through Emergency Directive 19-01.

On October 21, 2016, a DDoS attack powered by the Mirai IoT botnet hit DNS provider Dyn in three waves, making Twitter, Netflix, Reddit, Spotify, GitHub, Airbnb, PayPal, and other services unreachable for many users — a Domain Mayday case study in DNS provider concentration.

In September 2017, attackers logged into Dutch security firm Fox-IT's third-party domain registrar, changed its DNS, fraudulently obtained a TLS certificate, and ran a 10-hour man-in-the-middle on client traffic — until Fox-IT caught it and published one of the most transparent post-mortems in the industry.

GoDaddy says hosting incidents disclosed between 2020 and 2022 were part of a multi-year threat campaign that exposed 1.2 million Managed WordPress customers and redirected some hosted websites. A close look at provider concentration risk — and at what the disclosures do not establish.

In late 2014, spear-phishing emails spoofing ICANN's domain harvested staff credentials and enabled administrative access to files in the Centralized Zone Data System. A close look at the copied gTLD zone data and user information that were exposed — and the critical IANA systems that were not affected.

On February 25, 2015, attackers changed Lenovo.com's nameserver and mail routing, sending visitors to a webcam slideshow and exposing some email traffic. Researchers attributed the incident to a Webnic compromise, but Webnic did not publicly confirm their reported exploit chain.

In January 2015, Lizard Squad hijacked the DNS of malaysiaairlines.com and replaced the airline site with a tuxedo-wearing lizard and the taunt "404 — Plane Not Found." No server was breached — the attackers simply changed where the domain pointed. A Domain Mayday deep-dive into how DNS became the airline's most exposed front door.

On April 24, 2018, attackers hijacked the internet routing for Amazon Route 53, poisoned DNS answers for myetherwallet.com, and served a phishing clone behind a self-signed certificate — draining roughly $150,000 in Ethereum. A Domain Mayday deep-dive into why DNS rides on a routing layer that trusts by default.

In January 2005, panix.com — the domain of New York's oldest commercial ISP — was fraudulently transferred through a reseller account opened with stolen credit-card details. ICANN's review found a failure to obtain express authorization, not a flaw introduced by the then-new transfer policy.

In late January 2021, perl.com — a decades-old home of the Perl programming community — was stolen via a registrar-level account compromise, transferred through China, pointed at a malware-linked IP, and listed for $190,000. Here is how it happened, how it was recovered, and what it teaches about registrar account security.

How "Sea Turtle," a state-sponsored campaign disclosed by Cisco Talos in 2019, hijacked DNS through registrars, registries, and DNS providers — redirecting governments, ministries, and energy firms to attacker servers, obtaining CA-signed and other certificates for interception, and breaching a national TLD registry.

In 1995 a con man named Stephen Cohen stole sex.com from rightful owner Gary Kremen with a single forged letter to Network Solutions. The years-long fight to win it back ended in a $65 million judgment, a fugitive in Mexico, and a landmark ruling that domains are property.

In September 2021 an anonymous contractor slipped their own wallet address into SushiSwap's MISO launchpad front-end via a malicious commit, diverting 864.8 ETH (~$3M) from the Jay Pegs Auto Mart auction. A Domain Mayday deep-dive on code supply chains, front-end trust, and what it teaches about verifiable ownership.

On August 27, 2013, the Syrian Electronic Army phished a Melbourne IT reseller, rewrote the DNS records for nytimes.com and Twitter's domains, and took the New York Times offline for hours. A deep dive into how a registrar-chain weak link became a newspaper's front-door failure — and what registry locks would have changed.

Multisignature wallets are widely treated as the default secure custody pattern in crypto, but the answer to "do they actually improve security?" depends entirely on the threat model. This post walks through what multisig defeats, what it does not, and where it can make things worse.

DNS over HTTPS (DoH) protects user privacy by encrypting DNS queries inside HTTPS. Enterprise split-horizon DNS relies on the network being able to see those queries. The collision between the two is reshaping how corporate networks, browsers, and operating systems handle name resolution.

A registrar/DNS‑operations perspective on the October 20, 2025 AWS incident, how DNS actually works, why this failure propagated so widely, and what resilient internet teams can do about it.