Eth.limo Domain Hijacked via EasyDNS Social Engineering

A social engineering attack allowed an unauthorized actor to briefly hijack the domain for eth.limo, a key gateway to the Ethereum Name Service, after deceiving support staff at registrar EasyDNS into granting account recovery access late on April 17, 2024.

The incident began at 7:07 p.m. Eastern Daylight Time when the attacker, posing as an eth.limo team member, contacted EasyDNS to initiate a fraudulent recovery process. By 2:23 a.m. the next day, the perpetrator altered the domain's nameserver records to point to Cloudflare infrastructure. A second change at 3:57 a.m. redirected traffic to Namecheap. EasyDNS restored legitimate control to the eth.limo operators at 7:49 a.m., ending about five hours of unauthorized access. The eth.limo team detected the breach through automated alerts and promptly notified the community, including Ethereum co-founder Vitalik Buterin.

Eth.limo serves as a reverse proxy that enables standard web browsers to access content linked to approximately 2 million .eth domains hosted on decentralized storage like IPFS, Arweave or Swarm. A full compromise could have redirected users across these sites, including Buterin's personal blog at...