Home / News

An Investigation Shows How Bomb Threat Scammers Hijacked Thousands of Big-Name Domains

The threatening emails sent on December 13 caused mass evacuations, closures, and lockdowns in the US, Canada, and other countries around the world. The emails threatened to blow up buildings and schools unless recipients paid a $20,000 ransom. Ars Technica’s Dan Goodin reports that an “investigation shows the spam run worked by abusing a weakness at GoDaddy that allowed the scammers to hijack at least 78 domains belonging to Expedia, Mozilla, Yelp, and other legitimate people or organizations.”

Analysis of historical Internet records by Researcher Ronald Guilmette lead him to believe that the stolen domain names were *not* simply ones that some bad actor has put entirely fraudulent WHOIS data in for. Goodin writes: “After noticing that virtually all of the affected domains were receiving domain-resolution service from GoDaddy prior to being hijacked, Guilmette theorized that a system-wide vulnerability was somehow involved.”

Godaddy has since issued a response confirming that threat actor(s) abused our DNS setup process. “We’ve identified a fix and are taking corrective action immediately.”

By CircleID Reporter

CircleID’s internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us.

Visit Page

Filed Under


Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byDNIB.com

New TLDs

Sponsored byRadix


Sponsored byVerisign

Domain Names

Sponsored byVerisign

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

Threat Intelligence

Sponsored byWhoisXML API