For Just $20, Researchers Seize Part of Internet Infrastructure

Security researchers registered an expired WHOIS hostname previously used by the .mobi TLD and unexpectedly received millions of queries from tens of thousands of systems (including registrars, government mail servers, and security services). Their experiment showed that some Certificate Authorities rely on WHOIS data for domain control validation, allowing an attacker controlling an outdated WHOIS host to supply arbitrary administrative contact information and obtain fraudulent TLS/SSL certificates or perform passive traffic analysis. The finding highlights a systemic weakness in WHOIS-based verification, the real-world scale of the issue, and mitigations taken (ShadowServer sinkholing the domain).