New research details how two widely received spam email campaigns over the past few months were made possible by a previously detailed weakness at GoDaddy.com
Two of the most disruptive and widely-received spam email campaigns over the past few months — including an ongoing sextortion email scam …
Context & Ripple Effects
Krebs on Security's reporting pins two of the most disruptive spam waves of recent months — including an ongoing sextortion scheme — on a weakness at GoDaddy that had already been flagged in prior coverage. That makes GoDaddy the connective tissue between otherwise unrelated campaigns.
It also foreshadows a pattern the corpus keeps confirming: GoDaddy resetting passwords and taking down 15,000+ abused subdomains months later, staff falling to social engineering that let hackers alter DNS records for crypto trading platforms, and a multiyear breach discovered in December 2022 in which attackers stole source code and installed malware on its servers.
First-order effects
- GoDaddy comes under immediate pressure to close the named weakness, since its own infrastructure is what allowed the sextortion and companion campaigns to reach inboxes at scale.
- Recipients and mail administrators bear the direct cost now: filtering out high-volume fraudulent mail that carries legitimate-looking sending characteristics.
Second-order effects
- Domain and email reputation systems shift burden onto registrars — GoDaddy's repeated incidents give rivals and enterprise buyers a concrete reason to demand stronger account controls before delegating DNS and mail records.
- Abuse migrates toward whatever access path remains cheapest, as later coverage shows spammers pivoting to hijacking 21K abandoned domains and subdomains from brands like eBay, MSN, and VMware when one vector gets closed.
Third-order effects
- If registrar-side weaknesses keep enabling campaigns at this cadence, registrars stop being neutral plumbing and become accountable chokepoints in email-trust infrastructure — with pressure for audits, mandatory controls, and regulator attention to how DNS records get changed.
- Brand owners face a structural exposure beyond their own perimeter: their domains and subdomains can be weaponized at scale through third-party registrar compromise, making registrar security a board-level supply-chain concern.
The trend: Domain registrars are emerging as a recurring single point of failure in email fraud, with each exposed weakness at a major player like GoDaddy converting directly into large-scale spam and phishing capability.