Scammer Used Fake Court Order to Take over Dark Web Drug Market Directory
vice.com
vice.com
https://twitter.com/darkdotfail/status/1388215868308561920?s...
- scammer presents Tucows with fake domain seizure order and gag order covering seizure
- Tucows hands over control of domain and per gag order doesn't inform retail registrar / domain owner
- scammer modifies domain owner's darkweb directory and replaces links to markets with phishing links
Crafty.
Taking the decision away from the registrars would require having different accounts with multiple registrars in multiple regions, different payment methods and use a unique domain on each registrar to have a status consensus API or TXT records for people to validate against. I would probably just put a simple cryptographic public key in a TXT record on each of the domains and publish a simple script that uses "dig" and "openssl" to verify sanity. To avoid relying upon EDNS0 one could break up the key into multiple TXT records. This may be more work than people would accept and assumes you have a technically inclined community. This also assumes the members of your community chat with each other out-of-band on something like using signal or some other secure means of out-of-band consensus. This is also not perfect but may be sufficient.
Multiple domains through multiple registrars seems like the only work around.
You could establish 3 domains for a user to recognize: application.com, application-login.com, and application-announcements.com
Users know to go to the login domain, and know to verify they are sent to application.com.
Users know that all announcements appearing on the login or application domain would also be posted to the announcement domain for verification.
On the login domain you would only enter a username and then be forwarded to a password page on the application domain.
An attacker would have to take control of 2 domains to get your password, and all 3 to intercept payments.