Microsoft surrenders the 23 domains it recently confiscated from No-IP
Order restored to universe as Microsoft surrenders confiscated No-IP domains — Microsoft has surrendered the 23 domain names it confiscated from dynamic domain hosting service No-IP.com, a move that begins the process …
Context & Ripple Effects
On June 30, Microsoft used a US court order to take over 23 No-IP domains it said were heavily abused by malware, and pointed them at its own servers — instantly breaking dynamic DNS service for millions of legitimate users, as our earlier report on the seizure's collateral damage documented. The backlash from customers and the wider security community was immediate.
Three days later, Microsoft has handed all 23 domains back, an unusually fast public retreat for a company that framed the operation as a malware-fighting necessity. The episode echoes Apple's 2010 seizure of 16 domains in showing how a vendor acting through court orders rather than registrar channels can break unrelated users first and ask questions later.
First-order effects
- No-IP's customers regain resolution on their hostnames, ending days of broken remote-access setups, cameras, and game servers that depended on the seized domains.
- Microsoft loses the sinkhole vantage point it had just gained over traffic to those 23 domains, weakening the filtering capability that justified the takeover.
Second-order effects
- The speed of the reversal puts pressure on Microsoft and other vendors running similar operations to build pre-seizure coordination with DNS providers like No-IP, so legitimate traffic can be filtered without confiscating whole domains.
- Domain registrars and hosting intermediaries gain a fresh argument against vendor-led court-order takeovers, having watched a well-resourced company concede its own action was too blunt to sustain.
Third-order effects
- If botnet-disruption campaigns keep producing this kind of collateral damage, the industry structure shifts toward negotiated takedown protocols between security vendors and infrastructure operators, rather than ex parte court orders executed unilaterally by a single company.
- The precedent cuts both ways: courts have shown they will grant vendors control of third-party domains, but also that sustained public and customer pressure can force a return — shaping how aggressively vendors pursue such orders in future campaigns.
The trend: Vendor-led domain seizures for botnet disruption are hitting a wall of collateral damage, pushing the industry toward coordinated takedowns instead of unilateral court-order confiscation.