Instagram buying domains to deter hackers from selling data

The social media company appears to have spent the long weekend buying up internet domains that hackers might try to use to sell contact information stolen last week from 6 million accounts.

Instagram appears to have spent the long weekend buying up internet domains that hackers might try to use to sell contact information stolen last week from as many as 6 million of the social media app’s 700 million user accounts.

A company spokeswoman declined to comment Tuesday to CyberScoop about a news report over the weekend that Instagram, through brand reputation management outfit Mark Monitor, had been buying up hundreds of web domains using the word “Doxagram.” That’s the name of the website first used by hackers to sell for $10 a pop the stolen data scraped from Instagram through a security flaw in an application programming interface or API.

Last week, the hackers were kicked off Doxagram.com and two other sites they subsequently migrated to. Over the weekend the appeared to find a home on the dark web, where the Tor service bounces encrypted traffic around the internet to disguise its origin and destination.

The Daily Beast reported the 280 domain buys on Monday night, using internet records maintained by RiskIQ’s Passive Total DNS . The domains purchased included doxagram.lol, doxagram.website, and doxagram.org, according to the Daily Beast. “The domains list a Facebook email address as the point of contact, and ‘Instagram LLC’ as the domain administrator,” and were purchased through registrar Mark Monitor, the publication reported. Mark Monitor did not respond to a request for comment.

Hackers told the Daily Beast and other online news outlets last week that they had successfully scraped 6 million accounts for user names, phone numbers and email addresses — but not passwords — exploiting a flaw in the API before Instagram patched it last week.

Security experts told CyberScoop that the attack should be a “wakeup call” for enterprises to give a higher priority to API security in their software development cycle.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure