How the Attacker’s Site Was Taken Down: The clientHold Timestamp in WHOIS, and a View from the Domain Business

日本語版: 日本語版

Also published on Site Scouter and Egosaru.

On 28 October, GMO Internet Group announced (Notice No. 13) that the domains of the site used by the party claiming to be the attacker in the “Onamae.com Desktop Cloud” breach, including its mirror, had been confirmed suspended at about 04:00 that day. This article records what that suspension looks like in the domain registration data, checked against the .store registry’s WHOIS and RDAP services, and gives the view of an author who has worked in the domain business. The incident itself, the search suggestions and the share prices are tracked in the flash edition (https://nkzw.jp/2026/10/27/gmo_incident_suggest_stock_security_investment_2026_en/), updated every business day.

1. What WHOIS and RDAP show

In the early hours of 29 October (JST) I queried the .store registry’s WHOIS server (whois.nic.store) and RDAP service (answered by the registry operator Radix at rdap.radix.host) for the attacker’s site and its mirror. The results:

A DNS query on the evening of 27 October showed the main domain delegated to the registrar’s hosting name servers and resolving to an IP address of the same hosting service. As of 29 October, neither domain exists in the .store zone when followed from the root, so neither resolves. The WHOIS “Updated Date” is the moment the status was changed. The two domains were updated six seconds apart, which indicates that one person or one batch operation put both on hold.

Registrant details are redacted in both WHOIS and RDAP under ICANN rules, so the query does not tell us who registered the domains.

2. Timeline: on hold about 16 hours after the deadline

Figure 1. Timeline to the suspension of the attacker’s domains (JST)

Overlaying the WHOIS timestamps on the company’s notices and the press reports gives the following sequence (JST):

• 27 and 31 August: the two domains are registered (about two months before the incident was disclosed)
• 26 October: a party claiming to be the attacker announces that customer data will be published and ransomware launched at noon on 27 October (press reports)
• 27 October, 12:00: the attacker’s deadline. GMO maintains that it will not pay
• 27 October, after 13:00: press reports that the attacker published one item of what appears to be personal data (authenticity unknown)
• 27 October, 14:55: GMO Notice No. 11 confirms that the data of visitors to the attacker’s site was being collected by the attacker
• 27 October, 19:10: GMO Notice No. 12 announces the bounty programme and special condolence payments
• 28 October, 03:35-03:36: clientHold is set on both domains (WHOIS Updated Date)
• 28 October, about 04:00: GMO confirms the suspension (Notice No. 13)
• 28 October, 11:00: Notice No. 13 is published, describing the suspension as the result of working with the relevant providers

That is about 15 and a half hours from the noon deadline, and about 12 and a half hours from Notice No. 11. Press reports say the US provider used by the attacker appears to have suspended the domains for violating its terms of service; the WHOIS record is consistent with that. The registrar has not published its reasons, so nothing beyond the reports is known.

3. What clientHold is: the fastest lever a registrar has

clientHold is one of the domain status codes (EPP status codes) defined by ICANN; it is a hold set by the registrar (https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en). A domain on clientHold is removed from the TLD zone file, its name-server delegation disappears, and it stops resolving everywhere. The registration itself is not deleted: the record and the WHOIS entry remain until the expiry date (August 2027 for these two). The accompanying clientTransferProhibited status blocks transfers to another registrar.

The similarly named serverHold is set not by the registrar but by the registry (here Radix, which operates .store) and cannot be lifted by the registrar. Freezes ordered by a court or requested by law enforcement are more often applied at that level. The record here shows clientHold only, which means the domains were stopped at the registrar’s discretion.

Suspending hosting and putting a domain on hold are different things. On the evening of 27 October the site was on hosting run by the registrar’s own group. Suspending only the hosting account leaves the WHOIS status unchanged, and the domain can be pointed at another server and be back within minutes. Putting the domain on hold stops it resolving wherever the server is moved. The latter was done here. That the registrar and the hosting provider belonged to the same group is probably one reason the action could be taken in one step.

Why “the registrar, not the hosting provider, stopped it”

Because the name servers are still listed in WHOIS, it is fair to ask whether it was the hosting provider rather than the domain that was stopped. The record shows a registrar action, for the following reasons.

1. Only the registrar can set clientHold. Section 2.3 of RFC 5731, which defines the EPP protocol used for domain registration, states that status values “can be set only by the client that sponsors a domain object and by the server on which the object resides”, and that values prefixed with “client” are added or removed by the client, i.e. the registrar. ICANN’s explanation of the status codes likewise says clientHold is “set by your domain’s registrar” and “tells your domain’s registry to not activate your domain in the DNS”, so that it “will not resolve”. A hosting company has neither the authority nor the channel to change a status in the registry database.
2. Name servers staying in WHOIS is how clientHold works. RFC 5731 specifies for clientHold and serverHold that “DNS delegation information MUST NOT be published for the object”. The name servers remain in the registration data; only their publication in the zone stops. That is exactly what the 29 October queries showed: name servers present in WHOIS, NXDOMAIN in DNS (the domains are absent from the .store zone). A hosting-only suspension looks the opposite: DNS still resolves to the IP address, and the browser shows a suspension page or a connection error.
3. It matches the registrar’s own description. Namecheap’s support article says that “Client Hold status is assigned by the domain registrar, mostly for reasons related to fraudulent/abusive activity” or for “non-compliance with our Terms of Service”, and names its Legal & Abuse team as the contact. It also states that serverHold “is set by the domain registry (not Namecheap)”.
4. Registrar and hosting provider were the same company. At the time of capture on the evening of 27 October, the main domain resolved to 198.54.116.91. ARIN’s RDAP shows that address allocated to Namecheap, Inc. (198.54.112.0-198.54.127.255); the name servers were the company’s hosting name servers (namecheaphosting.com), and the HTTP response header was LiteSpeed, the server software used on its shared hosting. So “the hosting provider stopped it” and “the registrar stopped it” point to the same company. The precise statement is that the action recorded is a registrar-side clientHold.

The press description “the US provider suspended it for terms-of-service violations” is therefore most consistent with a clientHold applied by the company’s Legal & Abuse team under its terms of service. Since the registrar has not published its reasons, this remains an inference.

From an evidence standpoint, too, a hold is the right choice rather than deletion. Deleting the domain starts the registrar’s and registry’s expiry process and opens the possibility of re-registration. With a hold, the registrant details, payment data and access logs stay with the registrar and can be provided to investigators on request.

4. A view from the domain business

I formerly sat on the executive committee of the domain and server business at a GMO group subsidiary, and I now run a business that handles domain backorders and previously registered (aged) domains. From that position, these are my views on the suspension.

First, this suspension was fast by industry standards. Registrar abuse desks receive large volumes of reports from around the world, and several days from report to action is not unusual. Fifteen and a half hours from the deadline is the result of a listed Japanese company working with the police. An individual or a small business hit by the same kind of attack should not expect the same speed. The quality of the report (screenshots, URLs, a description of the harm, law-enforcement involvement) translates directly into how fast a registrar acts. Nor was it a case of “the registrar acting on instructions from the US government”. When US authorities stop a domain, they do so under a court-issued seizure warrant, as in the international operation against LockBit in February 2024; such operations take months to prepare, and after seizure the name servers are normally replaced with the authorities’ own. For Japanese police to compel a US provider legally, the procedure under the Japan-US Mutual Legal Assistance Treaty (in force since 2006) is required, which also takes months. The record here shows only a clientHold with the name servers unchanged, so the natural reading is that the registrar acted on a report under its own terms, not under a warrant. A voluntary report or request from Japanese police or a victim company to a US provider has no binding force, but a report with evidence attached weighs heavily in the provider’s terms-of-service decision. What determined the speed was the quality and route of the report, not a government instruction.

Second, extortion and data-leak sites fall outside ICANN’s definition of DNS abuse. The amendments to ICANN’s Registrar Accreditation Agreement that took effect in April 2024 define “DNS Abuse” in section 3.18.2 as “malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse)”, and require that when a registrar “has actionable evidence that a Registered Name sponsored by Registrar is being used for DNS Abuse”, it “must promptly take the appropriate mitigation action(s) that are reasonably necessary”. A site that displays a threat and lists what it claims is stolen data fits none of the five. A suspension like this one is therefore carried out not under an ICANN obligation but under each registrar’s own terms of service and discretion. Because it is discretionary, the speed and the threshold differ from registrar to registrar, and for the victim the outcome depends on which registrar the attacker happened to use. This is a structural weakness of the industry, and I believe sites of this kind should be stoppable under a common standard rather than under individual terms of service.

Third, detecting this in advance is not realistic. The two domains were registered about two months before the incident was disclosed. A new gTLD such as .store costs a few hundred yen for the first year, and a harmless string that contains no brand name will not trigger the new-registration monitoring that companies run. Preparing several disposable domains in advance is standard practice for this kind of attacker. Rather than investing in early detection, it is more effective to write into your own response procedures the shortest path to a takedown after the fact: the registrar’s and hosting provider’s abuse desks, the IP address holder and, if needed, law enforcement. A WHOIS or RDAP lookup tells you where to report within a minute.

Fourth, clientHold is not the end. A hold is reversible: if the registrar lifts it, the site is back within minutes. The registrations run until August 2027. Mirrors and Tor sites are unaffected by a DNS suspension. The attacker can register a different name at a different registrar in minutes. GMO’s statement in Notice No. 13 that it will move to take down any similar site reflects this reality. Stopping a site conclusively takes a registry-level serverHold, a court-ordered freeze or transfer, and the ability to work with several registrars and registries at once.

Fifth, re-registration after expiry should be prevented. This touches my own business directly, so I will be explicit. If these domains reach their expiry date while on hold, they will go through the grace periods, be deleted and become available to anyone. A name used for an extortion notice lives on in search results, social media posts and news articles. Re-registered, it could be turned into a fake “data release” page or a phishing site. I run a backorder and aged-domain business, and I will not acquire domains like these; nor, in my view, should anyone in the industry. The right mechanism is for the registry to reserve such names so that they never return to the market.

Sixth, on the practical side for the victim company. “Working with the relevant providers” in Notice No. 13 means, concretely, reporting to the registrar, the hosting provider and the IP address holder, and requests from law enforcement. Most companies have no procedure for being the party that gets an attacker’s site taken down. I recommend adding “identify and report the attacker’s infrastructure” to the incident response plan, with WHOIS, RDAP and DNS lookup steps and a template report for abuse desks prepared in advance.

5. Limits and caveats

• Registrant details in WHOIS and RDAP are redacted; the registrant is unknown.
• The registrar has not published its reasons for the suspension. “Suspended for terms-of-service violations” is based on press reports.
• On 29 October I checked only DNS, WHOIS and RDAP. I did not access the attacker’s site itself. As GMO’s Notice No. 11 states, the data of visitors to that site was being collected by the attacker; if a site under the same name reappears, do not visit it.
• This article does not evaluate GMO group’s response. It records what public information and public registration data show about one point: the suspension of the domains.

Sources

• RFC 5731: Extensible Provisioning Protocol (EPP) Domain Name Mapping, 2.3 Status Values: https://www.rfc-editor.org/rfc/rfc5731#section-2.3
• ICANN: EPP Status Codes | What Do They Mean, and Why Should I Know?: https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
• Namecheap: Why was my domain suspended with a serverHold or clientHold status?: https://www.namecheap.com/support/knowledgebase/article.aspx/10717/46/why-was-my-domain-suspended-with-a-serverhold-or-clienthold-status
• ICANN: 2024 Global Amendments to the 2013 Registrar Accreditation Agreement (definition of DNS Abuse in 3.18.2: malware, botnets, phishing, pharming, and spam): https://itp.cdn.icann.org/en/files/accredited-registrars/registrar-accreditation-agreement-global-amendment-05apr24-en.htm
• .store registry WHOIS: whois.nic.store; RDAP: https://rdap.radix.host/rdap/domain/coronamng.store and https://rdap.radix.host/rdap/domain/designbuilder.store (queried 2026-10-29)
• ARIN RDAP (allocation of 198.54.116.91): https://rdap.arin.net/registry/ip/198.54.116.91
• Ministry of Foreign Affairs of Japan: Treaty between Japan and the United States of America on Mutual Legal Assistance in Criminal Matters: https://www.mofa.go.jp/mofaj/gaiko/treaty/treaty159_3.html
• KrebsOnSecurity (20 Feb 2024): Feds Seize LockBit Ransomware Websites: https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/
• GMO Internet Group, Notices No. 11, 12 and 13: https://group.gmo/info/alert/2026102704/, https://group.gmo/info/alert/2026102705/, https://group.gmo/info/alert/20261028/

Disclosure

I formerly worked at a GMO group subsidiary and sat on the executive committee of its domain and server business. I held shares in the group at one time, but I now have no relationship with it and hold no shares. I currently run a business that handles domain backorders and aged domains, and section 4 is written from that position. This article is based only on public information and public registration data, and uses nothing I learned while employed there. It is not investment advice.

About the author

Yuki Nakazawa (nkzw.jp)

• Website: nkzw.jp
• YouTube: @yknkzw
• Instagram: @nkzwyk
• LinkedIn: yukinakazawa
• X: @YukiNakazawa331
• Telegram: @yknkzw

2026.10.29 / written by Yuki Nakazawa

Update history

• 1st edition posted 2026-10-29 01:44 JST
• 2nd edition updated 2026-10-29 02:05 JST ()
• 3rd edition updated 2026-10-29 02:07 JST ()
• 4th edition updated 2026-10-29 02:16 JST (links to the Site Scouter and Egosaru editions added)