⚠️How can you tell a DNS is Hijacked when you visit an official...
NFT_Dreww.eth@nft_dreww
8 views
Oct 31, 2026
~1 min read
Advertisement
1
⚠️How can you tell a DNS is Hijacked when you visit an official website?..⚠️
At least 12+ domains got hijacked last night, serving wallet drainer code on their official website.. All but 5 have now moved their DNS to Vercel/Cloudflare to mitigate and those 5 are still compromised, DO NOT VISIT!
The URL can be 100% correct, but the website you're visiting can still be malicious.
This compromise did not break anything from the teams flow, setup, compromise anything they did, it appears someone inside name(.)com (The registrar) change the nameservers to the domains. If you use them as a registrar I would consider moving away and at minimum setup cloudflare for hosting/filtering.
If you are a user, there really isn't a way to detect this unless you are checking WhoIs, DNS updates, ASN numbers, and many more which most don't. The only way to tell is that when you go to the website it will ask for your seed phrase/private key, or prompt you to sign an odd transaction. The transaction part is tough to spot which is why I recommend always using @RevokeCash extension to help spot this for you with the transaction simulator...
If you are a business and not using cloudflare, let's talk, this is basic proper security on domains outside of domain lock, etc. You have to be prepared ahead of time to prevent/mitigate this in an instance moment!
Stay Safe & Stay Vigilant
At least 12+ domains got hijacked last night, serving wallet drainer code on their official website.. All but 5 have now moved their DNS to Vercel/Cloudflare to mitigate and those 5 are still compromised, DO NOT VISIT!
The URL can be 100% correct, but the website you're visiting can still be malicious.
This compromise did not break anything from the teams flow, setup, compromise anything they did, it appears someone inside name(.)com (The registrar) change the nameservers to the domains. If you use them as a registrar I would consider moving away and at minimum setup cloudflare for hosting/filtering.
If you are a user, there really isn't a way to detect this unless you are checking WhoIs, DNS updates, ASN numbers, and many more which most don't. The only way to tell is that when you go to the website it will ask for your seed phrase/private key, or prompt you to sign an odd transaction. The transaction part is tough to spot which is why I recommend always using @RevokeCash extension to help spot this for you with the transaction simulator...
If you are a business and not using cloudflare, let's talk, this is basic proper security on domains outside of domain lock, etc. You have to be prepared ahead of time to prevent/mitigate this in an instance moment!
Stay Safe & Stay Vigilant
