{"id":50647,"date":"2023-02-20T02:27:10","date_gmt":"2023-02-20T02:27:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/"},"modified":"2023-02-20T02:27:10","modified_gmt":"2023-02-20T02:27:10","slug":"godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/","title":{"rendered":"GoDaddy joins the dots and realizes it&#8217;s been under attack for three years"},"content":{"rendered":"<p><span class=\"label\">In brief<\/span> Web hosting and domain name concern GoDaddy has disclosed a fresh attack on its infrastructure, and concluded that it is one of a series of linked incidents dating back to 2020.<\/p>\n<p>The business took the unusual step of detailing the attacks in its <a target=\"_blank\" href=\"https:\/\/d18rn0p25nwr6d.cloudfront.net\/CIK-0001609711\/e4736ddb-b4c7-485b-a8fc-1827691692c9.pdf\" rel=\"noopener\">Form 10-K<\/a> \u2013 the formal annual report listed entities are required to file in the US.<\/p>\n<p>The filing details a March 2020 attack that &#8220;compromised the hosting login credentials of approximately 28,000 hosting customers to their hosting accounts as well as the login credentials of a small number of our personnel&#8221; and a November 2021 breach of its hosted WordPress service.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>The latest attack came in December 2022, when boffins detected &#8220;an unauthorized third party gained access to and installed malware on our cPanel hosting servers,&#8221; the filing states. &#8220;The malware intermittently redirected random customer websites to malicious sites.&#8221;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>GoDaddy is unsure of the root cause of the incident, but believes it could be the result of &#8220;a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy.&#8221;<\/p>\n<p>&#8220;To date, these incidents as well as other cyber threats and attacks have not resulted in any material adverse impact to our business or operations,&#8221; the filing states \u2013 showing enormous empathy for customers whose sites were redirected in the most recent attack, or impacted by the earlier incidents.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>In a <a target=\"_blank\" href=\"https:\/\/aboutus.godaddy.net\/newsroom\/company-news\/news-details\/2023\/Statement-on-recent-website-redirect-issues\/default.aspx\" rel=\"noopener\">brief statement<\/a> on the incident, GoDaddy hypothesized that the goal of the December 2022 attacks &#8220;is to infect websites and servers with malware for phishing campaigns, malware distribution and other malicious activities.&#8221;<\/p>\n<p> <i>\u2013 Simon Sharwood<\/i>\n<\/p>\n<h3 class=\"crosshead\">Moscow considers legalizing hacking \u2013 but only for the glory of Mother Russia<\/h3>\n<p>The Russian government is working on changes to its criminal code that would legalize hacking in the Federation \u2013 provided it&#8217;s being done in the service of Russian interests, of course.&nbsp;<\/p>\n<p>According to Russian news service TASS, Alexander Khinshtein, head of the state Duma committee on information policy, wants exemptions from liability given to hackers, but aside from tossing the idea out to reporters he didn&#8217;t have details to add.&nbsp;<\/p>\n<p>Still, Khinshtein argued, &#8220;I am firmly convinced that it is necessary to use any resources to effectively fight the enemy,&#8221; adding that Russia needs to be able to respond adequately to any threat \u2013 and who better to help than a well-established army of hackers?<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Russian-linked hacking groups are notorious for the <a href=\"https:\/\/www.theregister.com\/2022\/02\/15\/ukraine_cyberattack\/\">damage<\/a> caused \u2013 or <a href=\"https:\/\/www.theregister.com\/2022\/11\/02\/killnet_us_treasury_ddos\/\">attempted<\/a> \u2013 by groups like Killnet, <a href=\"https:\/\/www.theregister.com\/2022\/07\/06\/brc4_state_sponsored_apt29\/\">Cozy Bear<\/a>, <a href=\"https:\/\/www.theregister.com\/2022\/09\/07\/vice_society_ransomware_education\/\">Vice Society<\/a> or any of the myriad others linked to <a href=\"https:\/\/www.theregister.com\/2022\/08\/11\/black_hat_hacktivists\/\">attacks<\/a> on its enemies \u2013 both in <a href=\"https:\/\/www.theregister.com\/2022\/03\/01\/ukraine_wiper_apple_visa_mastercard\/\">Ukraine<\/a> and <a href=\"https:\/\/www.theregister.com\/2022\/08\/11\/black_hat_hacktivists\/\">elsewhere<\/a>.&nbsp;&nbsp;<\/p>\n<p>Those groups may operate with a certain amount of impunity within Russia, but the law still isn&#8217;t on their side, as TASS pointed out. <a href=\"http:\/\/www.consultant.ru\/document\/cons_doc_LAW_10699\/4398865e2a04f4d3cd99e389c6c5d62e684676f1\/\" rel=\"nofollow\">Russian laws regarding cyber crimes<\/a> are strict \u2013 if not always enforced \u2013 and exceptions are <a href=\"https:\/\/cybernews.com\/news\/russia-cybercrime-for-homeland\/\" rel=\"nofollow\">reportedly<\/a> nonexistent.&nbsp;<\/p>\n<p>Two sets of laws pertain to hacking activity: Articles <a href=\"http:\/\/www.consultant.ru\/document\/cons_doc_LAW_10699\/5c337673c261a026c476d578035ce68a0ae86da0\/\" rel=\"nofollow\">272<\/a> and <a href=\"http:\/\/www.consultant.ru\/document\/cons_doc_LAW_10699\/a4d58c1af8677d94b4fc8987c71b131f10476a76\/\" rel=\"nofollow\">273<\/a> of the Criminal Code of the Russian Federation, which cover illegal access and the creation, distribution and use of malicious computer software, respectively.&nbsp;<\/p>\n<p>Gaining illegal access and\/or using malicious software, if it leads to &#8220;grave consequences or [the creation of] a threat,&#8221; can earn a Russian up to seven years in prison, with lesser possible terms for less damage or acting independently of a group.<\/p>\n<p>Adding exceptions for what TASS described as &#8220;white hat&#8221; operations in the interest of the Russian government would provide considerable leeway for state-sponsored hackers already doing so.<\/p>\n<p>More alarming, however, is the encouragement it would give to green hats more likely to break a system than break into it, script kiddies in it for the lulz, and dark web turnkey crooks. There&#8217;s no indication such a law is on the way to passage \u2013 Khinshtein said it still needed to be spoken about &#8220;in more detail&#8221; \u2013 but it might be a good idea to reinforce that security posture. Especially if you&#8217;re in a <a href=\"https:\/\/www.theregister.com\/2022\/04\/21\/five_eyes_russia\/\">critical industry<\/a>.<\/p>\n<div class=\"boxout\" readability=\"30.593612657486\">\n<h3 class=\"crosshead\">Critical vulnerabilities of the week<\/h3>\n<p>We&#8217;re still hot on the heels of February&#8217;s rather romantic <a href=\"https:\/\/www.theregister.com\/2023\/02\/14\/microsoft_adobe_patch_tuesday\/\">Patch Tuesday<\/a>, so if you&#8217;re wondering where a few well-publicized vulnerabilities are in this list \u2013 we may have already covered them.&nbsp;<\/p>\n<p>That said, there&#8217;s still plenty of patching fun to be had if you&#8217;re not sick of it already.&nbsp;<\/p>\n<ul>\n<li>CVSS 10.0 \u2013 <a href=\"https:\/\/www.cisa.gov\/uscert\/ics\/advisories\/icsa-23-047-10\" rel=\"nofollow\">CVE-2023-24482<\/a>: Siemens COMOS plant engineering software contains a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code and cause a denial of service;&nbsp;<\/li>\n<li>CVSS 9.8 \u2013 <a href=\"https:\/\/www.cisa.gov\/uscert\/ics\/advisories\/icsa-23-047-03\" rel=\"nofollow\">CVE-2022-1343<\/a>: Siemens Brownfield Connectivity Client contains several vulnerabilities able to cause a denial-of-service condition;<\/li>\n<li>CVSS 9.8 \u2013 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-46169#range-8643837\" rel=\"nofollow\">CVE-2022-46169<\/a>: Open source operational monitoring and fault management software Cacti contains a command injection vulnerability which is not new, but CISA said it has recently spotted being exploited in the wild, so <a href=\"https:\/\/github.com\/Cacti\/cacti\/commit\/7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216\" rel=\"nofollow\">patch now<\/a>;<\/li>\n<li>CVSS 9.8 \u2013 <a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-22-300\" rel=\"nofollow\">CVE-2022-39952<\/a>: FortiNAC web server may allow an unauthenticated attacker to perform an arbitrary write due to an external control of file name path vulnerability (now patched);<\/li>\n<li>CVSS 9.3 \u2013 <a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-21-186\" rel=\"nofollow\">CVE-2021-42756<\/a>: FortiWeb&#8217;s proxy daemon has multiple stack-based buffer overflow vulnerabilities that can allow an unauthenticated attacker to achieve arbitrary code execution.&nbsp;<\/li>\n<\/ul>\n<p>Mozilla&#8217;s <a href=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-05\/#CVE-2023-25730\" rel=\"nofollow\">Firefox 110<\/a>, <a href=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-06\/\" rel=\"nofollow\">Firefox ESR 102.8<\/a> and <a href=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-07\/\" rel=\"nofollow\">Thunderbird 102.8<\/a> were also released this week, and addressed a total of eight CVEs shared by a mix of the three products. As Mozilla&#8217;s bug reports are restricted and it doesn&#8217;t provide actual CVSS scores, we&#8217;ve selected bugs it rates as high priority, defined as those that can be used to gather sensitive data and &#8220;requiring no more than normal browsing actions.&#8221;&nbsp;<\/p>\n<p>None of the bugs Mozilla patched in this release were considered critical.&nbsp;<\/p>\n<ul>\n<li>CVE-2023-0767: Maliciously-crafted PKCS 12 files can be used to trigger arbitrary memory writes;<\/li>\n<li>CVE-2023-25728: the Content-Security-Policy-Report-Only header can be abused to leak child iframe unredacted URI;<\/li>\n<li>CVE-2023-25730: Requesting fullscreen mode and then blocking the main thread can force Firefox into fullscreen mode indefinitely, allowing confusion or spoofing attacks;<\/li>\n<li>CVE-2023-25735: Firefox&#8217;s Spidermonkey JavaScript engine has a use-after-free bug due to a compartment mismatch;<\/li>\n<li>CVE-2023-25737: An invalid downcast from nsTextNode to SVGElement can cause undefined behavior;<\/li>\n<li>CVE-2023-25738: Firefox on Windows is experiencing problems whereby printing is crashing device drivers;<\/li>\n<li>CVE-2023-25739: Failed module load requests aren&#8217;t being checked, leading to user-after-free vulnerabilities in ScriptLoadContext;<\/li>\n<li>CVE-2023-25743: Firefox Focus doesn&#8217;t include a notification for entering fullscreen mode, which could allow malicious website spoofing.<\/li>\n<\/ul>\n<ul>\n<li>CVE-2023-25743: Firefox Focus doesn&#8217;t include a notification for entering fullscreen mode, which could allow malicious website spoofing.<\/li>\n<\/ul>\n<p>Finally, <a target=\"_blank\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-24809\" rel=\"noopener\">CVE-2023-24809<\/a> won&#8217;t keep anyone up at night, unless they are avid players of the venerable Rogue-like adventure game NetHack. The 5.5-rated flaw is found in versions 3.6.2 through to 3.6.6 and means illegal input to the &#8220;C&#8221; (call) command can cause a buffer overflow and crash the NetHack process. &#8220;This vulnerability may be a security issue for systems that have NetHack installed suid\/sgid and for shared systems&#8221;, an advisory warns. Upgrading to version 3.6.7 solves the problem. No save-scumming, people!<\/p>\n<\/div>\n<h3 class=\"crosshead\">Emergency declared in Oakland, CA after ransomware attack<\/h3>\n<p>Oakland, California declared a state of emergency on Valentine&#8217;s Day \u2013 and not because there was too much love in the air. A week of work hasn&#8217;t done a whole lot to clear up a ransomware attack that hit the city on February 8.<\/p>\n<p>As we reported in <a href=\"https:\/\/www.theregister.com\/2023\/02\/13\/lockbits_royal_mail_ransom_deadline\/\">last week&#8217;s<\/a> security roundup, the attack didn&#8217;t take down 911 services, disrupt finances or worsen emergency response times, but the precaution of taking a good portion of the city&#8217;s network offline to stop the attack has led to a slow recovery and some non-emergency systems inaccessible.&nbsp;<\/p>\n<p>&#8220;The network outage has impacted many non-emergency systems including our ability to collect payments, process reports, and issue permits and licenses,&#8221; the city <a href=\"https:\/\/www.oaklandca.gov\/news\/2023\/city-of-oakland-targeted-by-ransomware-attack-core-services-not-affected\" rel=\"nofollow\">declared<\/a> in an update on February 15, adding that residents should call before showing up at a city office in case it&#8217;s closed.&nbsp;<\/p>\n<p>The Oakland government said that police and fire departments are still responding to emergency calls as usual, but that non-emergency requests should be made online or reported by a call to the local 311 non-emergency line.&nbsp;<\/p>\n<p>By declaring a state of emergency, Oakland has expedited its ability to procure equipment and materials to respond to the ransomware attack, as well as activating emergency workers and making it easier for leadership to issue orders.&nbsp;<\/p>\n<p>The Oakland city government said the attack investigation is ongoing, and law enforcement is investigating. The city hasn&#8217;t said how the attack occurred, who was behind it or what sort of ransom demand was made.&nbsp;\u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2023\/02\/20\/in_brief_security\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Also: Russia may legalize hacking; Oakland declares ransomware emergency; the CVEs you should know about this week In brief\u00a0 Web hosting and domain name concern GoDaddy has disclosed a fresh attack on its infrastructure, and concluded that it is one of a series of linked incidents dating back to 2020.\u2026  READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-50647","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GoDaddy joins the dots and realizes it&#039;s been under attack for three years 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GoDaddy joins the dots and realizes it&#039;s been under attack for three years 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-20T02:27:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"GoDaddy joins the dots and realizes it&#8217;s been under attack for three years\",\"datePublished\":\"2023-02-20T02:27:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/\"},\"wordCount\":1448,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/\",\"name\":\"GoDaddy joins the dots and realizes it's been under attack for three years 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2023-02-20T02:27:10+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GoDaddy joins the dots and realizes it&#8217;s been under attack for three years\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GoDaddy joins the dots and realizes it's been under attack for three years 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/","og_locale":"en_US","og_type":"article","og_title":"GoDaddy joins the dots and realizes it's been under attack for three years 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-02-20T02:27:10+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"GoDaddy joins the dots and realizes it&#8217;s been under attack for three years","datePublished":"2023-02-20T02:27:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/"},"wordCount":1448,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/","url":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/","name":"GoDaddy joins the dots and realizes it's been under attack for three years 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2023-02-20T02:27:10+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Y-MbCgI7@iMTJeYYA7bNogAAAIU&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/godaddy-joins-the-dots-and-realizes-its-been-under-attack-for-three-years\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"GoDaddy joins the dots and realizes it&#8217;s been under attack for three years"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/50647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=50647"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/50647\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=50647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=50647"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=50647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}