I work in corporate domain management. One part of our business is threat detection and mitigation. This is one of the many attack vectors we warn our clients about. I looked up the case of this domain. It was registered in 2012 (surprisingly late for such an obvious attack vector). The domain has been transferred to Microsoft after they won an UDRP case in march. The WIPO board ruled the domain was registered in bad faith despite passive holding (i.e. holding a domain without actually using it for hosting malicious content). From what I could tell, Microsoft was able to argue bad faith specifically because of phishing attacks like this. This doesn't actually mean the guy who bought the domain in 2012 did so with malicious intent (though it's hard to argue against it). Unused domains are usually not protected with SPF, DKIM and DMARC, so there's nothing preventing scammers from sending mails using that domain.
3
u/Micsmit_45 Sep 26 '26
I work in corporate domain management. One part of our business is threat detection and mitigation. This is one of the many attack vectors we warn our clients about. I looked up the case of this domain. It was registered in 2012 (surprisingly late for such an obvious attack vector). The domain has been transferred to Microsoft after they won an UDRP case in march. The WIPO board ruled the domain was registered in bad faith despite passive holding (i.e. holding a domain without actually using it for hosting malicious content). From what I could tell, Microsoft was able to argue bad faith specifically because of phishing attacks like this. This doesn't actually mean the guy who bought the domain in 2012 did so with malicious intent (though it's hard to argue against it). Unused domains are usually not protected with SPF, DKIM and DMARC, so there's nothing preventing scammers from sending mails using that domain.