“The results have been fairly stunning since — we have identified 135,000+ unique systems speaking to us, and as of 4th September 2024 we had 2.5 million queries,” the researchers wrote in their report. “A brief analysis of the results showed queries from (but certainly not limited to): Various mail servers for .GOV and .MIL entities using this WHOIS server to presumably query for domains they are receiving email from; various cyber security tools and companies still using this WHOIS server as authoritative (VirusTotal, URLSCAN, Group-IB as examples).”

Domain registrars such as GoDaddy and Name.com, various online WHOIS and SEO tools, and a large number of universities were also querying the old server address. Governments whose systems queried the now rogue WHOIS server included the US, Ukraine, Israel, India, Pakistan, Bangladesh, Indonesia, Bhutan, the Philippines, and Ethiopia.

The researchers have since worked with the UK’s National Cyber Security Centre and the Shadowserver Foundation to hand over dotmobiregistry.net and configure it to proxy correct WHOIS responses from whois.nic.mobi.