An attacker gains control of a domain's DNS records through a compromised registrar or DNS provider account, redirecting users and email to attacker infrastructure and enabling credential theft and fraudulent certificates.
Immediate Response
1Regain control of the registrar and DNS accounts and restore correct records.
2Rotate registrar, DNS provider, and API credentials and enable MFA.
3Revoke any certificates issued to attackers via the issuing CA.
4Force password resets for users who may have entered credentials on the spoofed site.
