A serious vulnerability in the way DNS records are created, left more than 500,000 expired domains at GoDaddy in the hands of cybercriminals.
While this was not a GoDaddy-specific issue, the ability to create free DNS records at GoDaddy, literally cost nothing to the perpetrators.
Expired domains with nameservers under domaincontrol.com, the domain for GoDaddy’s managed DNS service, were vulnerable. Despite not resolving, these domains were used in phishing and other malware campaigns.
Scammers used valid domains belonging to companies such as Yelp, Mozilla and Aramark to legitimize spam; by using these “clean” domains, anti-spam software failed to block the malicious email campaigns effectively.