Loading story…
GoDaddy is investigating allegations that it transferred control of a 27-year-old domain belonging to a U.S. nonprofit to another customer without enforcing the account’s configured authentication controls or obtaining valid supporting documentation. According to Flagstream Technologies partner Lee Landis and a separate writeup cited in reporting, the transfer was approved within four minutes on April 18 through an account recovery process and was attributed in the audit trail to an internal user. The nonprofit, which reportedly operates 20 locations, lost access to its website and email for four days after the domain disappeared from its GoDaddy account without notice.
Flagstream said GoDaddy staff may have confused the nonprofit’s primary domain with another domain that a woman identified as Susan was legitimately trying to recover, while both Flagstream and the unintended recipient disputed GoDaddy’s claim that proper documentation and authorization had been provided. The domain was restored only after the recipient realized she had received the wrong asset and cooperated directly to transfer it back, while GoDaddy support allegedly failed to resolve the issue despite repeated outreach. The incident has raised concerns over account recovery abuse, phishing, business email compromise, and the broader risk created when control of a domain’s web and email infrastructure is mistakenly reassigned.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
After the incident became public, GoDaddy said it was investigating the allegations, maintained that standard procedures had been followed with proper documentation and authorization, and said it was reinforcing processes to catch customer-representative miscommunications earlier.
The issue was resolved when the unintended recipient realized she had received the wrong domain and cooperated directly with Flagstream to transfer it back to the nonprofit. Reports said GoDaddy support had not resolved the problem despite repeated calls and emails before the recipient's intervention.
Following the erroneous transfer, the affected U.S. nonprofit reportedly lost control of its domain, causing about four days of website and email downtime across its operations. The incident raised concerns about potential phishing, business email compromise, and broader identity infrastructure abuse while the domain was under чужой control.
On April 18, GoDaddy allegedly approved an account recovery request within four minutes and transferred control of a 27-year-old nonprofit domain to another customer. Flagstream Technologies said the audit trail showed the action was initiated by an internal GoDaddy user without the account's configured authentication controls or valid supporting documentation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A senior **U.S. Secret Service** official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via **ASNs**) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email. Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating **PayBC, ServiceOntario, Canada Post, CRA, and Air Canada** to steal credentials and payment data. CloudSEK attributed much of the activity to the **“PayTool” phishing ecosystem**, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s `.ai` domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Jun 29, 2026
Security researchers who registered abandoned or commonly misused domains such as **`noreply.net`**, **`noreply.us`**, and **`deleteduser.com`** began receiving large volumes of misdirected automated email from companies, exposing a widespread data leakage problem. Reports say one domain alone received **401,796 messages** since December 2024—about 700 per day—with mail arriving from thousands of sender addresses and root domains. The messages were generated by corporate systems rather than individual users, showing that many organizations continue to route notifications and workflows to recycled, invalid, or poorly controlled addresses. The unintended emails reportedly included sensitive business and personal information, attachments, HR requests, hotel bookings, Zoom invitations, and other internal communications. Researchers said the issue stems from weak email hygiene, poor account deprovisioning, and unsafe use of placeholder or supposedly non-monitored addresses in automated systems. The findings highlight an avoidable exposure risk that can be reduced through stricter auditing of outbound email flows and the use of internal-only or guaranteed-invalid domains for non-deliverable addresses.
Aug 12, 2026
Silent Push disclosed research dubbed **DangleGeddon** showing that AI can sharply accelerate dangling DNS takeover attacks, in which a DNS record continues pointing to a deleted cloud resource and an attacker recreates that resource to seize the subdomain. Using Claude Opus 5 and automated workflows, the researchers said they processed roughly 12,500 domains, narrowed them to several hundred viable targets, and reached a stage where exploitation could be launched with minimal additional effort. The testing was conducted as a safe proof of concept and affected organizations were notified rather than exploited, but the exposed records reportedly included a U.S. federal government domain as well as assets tied to **Société Générale**, **Ford**, and **Eli Lilly**. Silent Push warned that compromised subdomains could be used for phishing, malware delivery, credential harvesting, and other targeted abuse, and said AI-enabled automation could let nation-state or criminal operators weaponize forgotten DNS records at global scale across government, banking, manufacturing, and pharmaceutical sectors.
Jul 31, 2026