eDomains/Catched.com got hacked?

[Hypersot]

Just tried to visit them and got a 'got hacked' page.

Can anyone check?

 

[Hypersot]

This is what I get when visiting edomains.com

 

[katerleonid]

What happened?

 

[Future Sensors]

What happened?

 

[Ali Mustafa]

From what I can see it looks like a ransomware related incident but I would not say it is confirmed yet The name CACTUS shown on the page does not necessarily mean the real CACTUS ransomware group is behind it That group has already faced major law enforcement action and many threat actors use famous ransomware names to create pressure It could also be that their hosting server or DNS was compromised and this page was placed there So far I have not seen any confirmed data leak posted anywhere Lets see what happens next I will keep an eye on it.

Most likely some random beginners or threat actors managed to compromise their DNS settings or hosting and redirected the domain to this page We still do not know exactly what happened so it is too early to confirm anything I wish I could get in touch with the edomains.com team I would be happy to help them investigate restore the service and clean up the compromise. They just need to point their nameservers back to their hosting server and run a malware scan or i can help.

Below is the real Cactus group which was taken down long time ago by agencies.

 

[Ali Mustafa]

I checked and the website appears to be hosted at Hetzner so one possibility is that the hosting account may have been compromised rather than the domain itself If that is the case the priority would be to regain access to the hosting panel investigate the compromise and restore a clean backup.

I just submitted an abuse report & also notified about this abuse to the Hetzner.com team so they are aware of the situation Since they do not appear to have a support ticket system on their website so notified them on X and LinkedIn Hopefully the issue gets resolved quickly.

 

[Hypersot]

It seems both websites are live again.

It is strange but, Kaspersky gave me alerts for many days now every time I tried to visit edomains.com . It didn't block the website but it went crazy with 'Threat of data loss' messages.