Recent Posts
- Typo left MasterCard open to hackers for years
- Could ICANN approve an R-word gTLD?
- These are the TLD growers and shrinkers of 2024 (part two)
- GoDaddy ordered to stop lying about crappy security
- These are the TLD growers and shrinkers of 2024 (part one)
- Dead terrorist domains for sale, just without the hyphens
- ICANN eyes more price hikes as it predicts dismal year for industry
- Meet the six people battling to join ICANN’s board
- New gTLD use cases not much use
- Defensive dot-brands are renewing, making ICANN millions
- Identity Digital offers free domain trials through LinkedIn
- Antisemitic remarks cost registrar dearly
- ICANN lawyers want to keep their clients secret
- Facebook cybersquatter asks ICANN to overturn UDRP ruling
- .xxx founder Stuart Lawley has died
- The new gTLD Next Round is really happening as two ICANN programs go live
- Verisign has much to be thankful for as .com contract renewed
- Another 40,000 .ai domains registered
- RDRS usage hits new low
- A dot-brand that was actually used is shutting down
- .id joins the million-domain club
- GoDaddy’s .xxx contract renewed
- Twitter clone Bluesky has one feature domain people should like
- ICANN confirms two bans on new gTLD gaming
- eBay slogan domain no longer has a BIN price
- Will Donald Trump be .io’s white knight?
- As customers flee legacy gTLDs, .org tops 11 million names
- Company accidentally puts porn domain on kids’ toys
- eBay’s new slogan looks like a $75,000 domain it doesn’t own
- Americans are deserting .com
- Weak Q3 for the domain universe, Verisign reports
- ICANN says it WILL raise its domain taxes soon
- Senator says domain industry “enables” Russian disinfo attacks
- bit.ليبيا? Libya to get its Arabic ccTLD
- Verisign gets eight more years running the root
- Two-horse race for open ICANN board seat
- Chinese say internet not ready for single-letter gTLDs
- Unloved INTA slams ICANN over new gTLDs
- Namecheap scores win in .org price-cap lawsuit
- Some Guy wants to take over .com and .net
- Second-shot gTLD bid rules revealed
- Nominet names directors after tight election
- Lawyer ban coming to ICANN
- Identity Digital to take over .ai
- ICA teams up with WIPO on UDRP reform
- Response to sex harassment lawsuit “inadequate”, say ICANN vets
- Unstoppable tops four million names
- Amazon readying fashion and book gTLDs
- Five times ICANN deleted a ccTLD, and what it means for .io
- Future of .io domains uncertain as UK hands over Chagos islands
- .ai now has over half a million names
- UK and Israel cut ICANN funding
- Twitter now up-to-date on linkification
- Moment of truth as .music domains finally go on sale
- ICANN fixes embarrassing “What is a Domain Name?” mistake
- Another ccTLD opens up its second level
- Reporter gains first access to .io island for decades
- .io sells $40 million of domains after massive uptick
- After five years, “useless” TLD has two web sites
- Verisign agrees to .com takedown rules
- New .com contract could see ALL domain prices go up
- Investing in .ad domains may be risky
- Plurals ban policy handed to ICANN board
- Three .now domains sell at premium EAP prices
- ICANN confirms new gTLD application fee
- New gTLD application fee rises by thousands after collision call
- Former .co registry defeated in $350 million contract fix case
- Is this the first Next Round new gTLD contention battle?
- ICANN names its Supreme Court judges
- Who uses Sunrise nowadays? You might be surprised
- ICANN gunning for Tencent over abuse claims
- All the one-character .sk domains to be auctioned
- Straggler gTLD signs first ICANN contract for years
- GoDaddy likely to win relaxed .xxx deal
- Tonkin promoted to CEO at auDA
- ICANN hires new Ombuds from WIPO
- Big twist as ICANN bans new gTLD auctions
- ICANN to “strengthen” harassment rules as it picks another homophobic meeting host
- .my global relaunch starts slowly despite cheapo prices
- Hackers break .mobi after Whois domain expires
- The new gTLD next, next and next round
- Squarespace gets sweetened $7.2 billion takeover offer
- ICANN hit by DDoS attack
- Russia calls for ICANN to split from US
- China loses over half a million domains
- ICANN to be director light for months
- FBI seizes Russian fake news domains
- Chinese registrars back in trouble after porn UDRP suspension
- Sataki quits ICANN board
- Microsoft switches two gTLDs from GoDaddy to Nominet
- ICANN homes in on new gTLD application fee
- Four more dot-brands switch back-ends
- Uzbekistan gets its first ICANN registrar
- Almost 100,000 .tr domains registered in one day
- ICA finally comments on .com pricing talks
- Unstoppable reveals gTLD bid doomed to fail
- RDRS usage stabilizing?
- “Frat boy culture” ICANN faces more sexual harassment claims
- Unstoppable gets ICANN accreditation
- AI and games among July’s interesting dot-brand domains
- ICANN U-turns on appeals loophole after community revolt
- ICANN to terminate five new gTLDs
- US could change .com pricing terms
- Two out, two in as NomCom picks new ICANN directors
- .cv domains now on sale worldwide
- It’s official, .internal is blocked forever
- Amazon to launch two new gTLDs this month
- Revealed: who’s really running Epik
- ICANN swaps out Asia VP
- No .uk price hikes despite tumbling sales
- Domain world growth despite .com slide
- Verisign predicts more gloom as registrars shun .com growth
- Republicans quiz NTIA on Verisign .com renewal
- Smaller, more intense ICANN meetings with no free cocktails?
- Private auctions to be banned in next new gTLD round
- .au prices going up
- Nominet names director hopefuls
- Crowdstrike screw-up took down ICANN’s email
- We grassed up .TOP, says free abuse outfit
- ICANN to earmark $10 million for new gTLD subsidies
- TV network rebrands on single-letter domain
- First registry gets breach notice over new abuse rules
- Americans and ICANNers avoid Kigali in droves
- RDRS stats improve a little in June
- Unstoppable Domains goes down after domain hijack
Typo left MasterCard open to hackers for years
A typo in MasterCard’s DNS configuration left the company open to hackers for years, it has emerged.
As first reported by Krebs On Security, from June 2020 until this month one of az.mastercard.com’s nameservers was set as akam.ne rather that akam.net, a domain used by DNS resolution provider Akamai.
The .ne version, in Niger’s ccTLD, was unregistered until security researcher Philippe Caturegli discovered the typo and spent $300 to secure the domain and check to see how much traffic it was getting, before handing it to MasterCard.
Had Caturegli been a bad actor, he could have used the domain to set up a man-in-the-middle attack, diverting a big chunk of traffic intended for mastercard.com to the server of his choosing.
MasterCard said its systems were not at risk and the typo has been corrected, Krebs reports.
MasterCard files UDRP on “priceless” geo domains
MasterCard recently registered several “priceless” domain names including the names of major cities and has filed cybersquatting complaints on seven more belonging to third parties.
The credit card company has this week entered UDRP complaints on pricelessistanbul.com, pricelessamsterdam.com, pricelessnewyork.com, pricelessmexico.com, pricelesslosangeles.com, pricelessparis.com and pricelesslondon.com.
The domains were registered separately by four different registrants over the last couple of years and are all parked, mostly with Go Daddy’s default parking page.
Interestingly, MasterCard also hand-registered several “priceless+city” domains at the end of November, including pricelessberlin.com, pricelesssydney.com pricelessmoscow.com, pricelessshanghai.com, pricelessmadrid.com and pricelessbangkok.com.
The company has not filed UDRP complaints about domains such as pricelessrome.com or pricelesssanfrancisco.com, which appear to belong to some of the same registrants.
It has also left the names of other popular city-break destinations unregistered. Domains such as pricelessprague.com, pricelessathens.com and pricelessdublin.com are currently available.
Could the company be working on a marketing campaign targeted only to specific cities?
The company has form when it comes to enforcing its long-held “priceless” trademark. It notably won control of priceless.org in an uncontested UDRP in 2007.
Recent Comments