Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
A misconfiguration in Microsoft's network caused test credentials for example.com to route to a Japanese company's domains, mainly affecting Outlook users. While routing was fixed, concerns over potential network vulnerabilities remain.
Cloudflare faces a €14.2 million fine from Italy for not blocking pirate sites on its 1.1.1.1 DNS service under the country's Piracy Shield law. The law requires rapid blocking of alleged piracy sites, but Cloudflare argues it could harm legitimate sites and plans to contest the fine, possibly withdrawing services in Italy. The Piracy Shield has faced criticism for overblocking legitimate sites and lacking due process.
Cloudflare removed Aisuru botnet domains from its top websites list after they manipulated rankings by usurping major sites like Amazon and Google. Aisuru, a growing botnet exploiting IoT devices, redirected traffic to Cloudflare's DNS services. Concerns arose over domain credibility, prompting Cloudflare to partially redact malicious domains. Experts criticized Cloudflare's ranking integrity, emphasizing the need to separate malicious domains to maintain trust. Aisuru continues to operate mainly through .su domains, raising security alarms as it impacts DNS traffic significantly.
https://krebsonsecurity.com/2025/11/cloudflare-scrubs-aisuru-botnet-from-top-domains-list/
DNS0.EU, a non-profit public DNS service, shut down due to unsustainable time and resource constraints. It recommended users transition to alternatives like DNS4EU or NextDNS for privacy-focused DNS resolution. The service offered features like no-logs, end-to-end encryption, and safety filters but ceased operations on October 20, 2025.
MasterCard fixed a major domain name server error that allowed potential interception of its Internet traffic due to a typo that went unnoticed for nearly five years. A security researcher, Philippe Caturegli, registered the misspelled domain for $300 to prevent exploitation. Although MasterCard asserted there was no real threat, Caturegli argued that the misconfiguration posed significant risks, potentially enabling Man-in-the-Middle attacks. After notifying MasterCard, he faced backlash for publicly disclosing the error, suggesting a need for better corporate acknowledgment of security vulnerabilities.
https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/
