An Expired Domain Left South Korea’s Cyber Security Agency Open to DNS Hijacking
For an unknown stretch of time, anyone could have registered a domain that ran part of the DNS of South Korea’s National Cyber Security Center. That is the agency where people report security holes in government systems.
Developer Antonio Cheong described the problem in a blog post dated Sunday, November 8. Two of the agency’s three nameservers, ns1.aegis-k.com and ns2.aegis-k.com, sat on a domain that had expired and was free to register. The agency’s domain, ncsc.go.kr, also had no DNSSEC, the signature system that lets resolvers reject forged answers.
South Korea fixed it within about two months of his report, Cheong writes. His scan turned up around 21 such cases on government domains worldwide, and he says the other countries “aren’t really responding.”
A Nameserver Domain Nobody Renewed
Nameservers tell the rest of the internet where a domain’s website and mail servers are. When a nameserver’s own domain lapses, whoever registers it next can run a nameserver under that name and answer a share of the lookups with addresses of their choice. Visitors can end up on a copy of the site, and mail can go to the new owner’s server.
Cheong’s DNS log from September 8, 2026 (Japan time) shows the .kr registry pointing ncsc.go.kr to ns1.aegis-k.com, ns2.aegis-k.com and the agency’s own ns.ncsc.go.kr. A registry lookup for aegis-k.com came back “not found.”
For most domains, that would be an embarrassing slip. The National Cyber Security Center belongs to the National Intelligence Service and works against foreign and state-backed hacking groups. Its site has a form for reporting vulnerabilities. Cheong points out that an attacker could have intercepted mail and internal traffic, including reports of government vulnerabilities.
The post doesn’t say how long aegis-k.com sat unregistered, or whether anyone had taken it before him. Cheong writes that he paid “a couple hundred dollars” to register all the expired nameserver domains he found, so nobody else could. The .com registry’s records show aegis-k.com was registered again on September 7, 2026, which fits his account.
Fixed at the Registry, Still Listed by the Agency
We checked the agency’s DNS on November 8 at 00:50 UTC. The .kr registry’s servers now send ncsc.go.kr to a single nameserver, ns.ncsc.go.kr. The fix Cheong describes is in place.
The agency’s own nameserver tells a different story. Asked which servers are responsible for ncsc.go.kr, it still names ns1.aegis-k.com and ns2.aegis-k.com next to itself. DNS rules rank a zone’s own records above the registry’s referral (RFC 2181), so resolvers that pick up that list can still send some lookups to servers on aegis-k.com. The zone is still not signed with DNSSEC either.
That is low-risk as long as the domain stays in safe hands. aegis-k.com is paid up until September 7, 2027. If it lapses before the agency deletes those two lines, the same domain goes back on the market, still named in a government zone.
About 20 More, and Nothing New About It
Cheong built his list of government domains from certificate transparency logs, the public records of issued TLS certificates, and checked each domain’s nameservers. He expected to find nothing: “Surely a problem that’s been around for so long has been fixed at this point.”
He found about 21. Apart from South Korea, he names none of them. He says he has no contacts in the other governments, is thinking about sending the list to ICANN and asks readers for an address to send it to. For anyone tempted to go hunting, he adds: “Don’t bother looking for the others.” He has registered them.
None of this is new. Researchers showed how to hijack domains through their nameservers at the ACM CCS conference in 2017. In 2019, Cisco Talos described Sea Turtle, a state-sponsored campaign that took over the DNS of at least 40 organizations in 13 countries, among them foreign ministries and intelligence agencies, and stole credentials and certificates. Sea Turtle got in through hacked registrars rather than expired domains, but in both cases someone else ends up answering the DNS.
Cheong says a post by a researcher named Lina made him look. In August 2026, Lina described how an expired domain carrying a fallback nameserver for the phone-number zones of Saint Helena, Diego Garcia and Ascension Island let her log about 400,000 lookups, with phone numbers and timestamps. She renewed it for €5 before the UK’s NCSC took the domain over.
What It Means for You
If you have reported something to the NCSC, there is nothing for you to do. Nothing in the post suggests anyone other than Cheong held the domain, though he doesn’t say how long it was open.
If you run a domain, the check takes a few minutes. List your domain’s NS records and make sure every nameserver’s domain is registered and renewed, especially names you set up yourself or kept from a former host. Turn on DNSSEC if your registrar and DNS host support it. A hijacked nameserver then can’t pass forged answers to resolvers that check signatures.
A cyber security agency is usually the one sending out this kind of advice.
Our Mission
We believe security online security matters and its our mission to make it a safer place.