A security experiment that began with a $20 domain purchase turned into a warning about how much of the internet still depends on old WHOIS assumptions. Researchers at watchTowr Labs said they re-registered `dotmobiregistry.net`, a domain once tied to the .mobi top-level domain's previous WHOIS service, after discovering it had expired. They then placed a WHOIS server behind the legacy hostname and watched large volumes of real-world traffic continue to arrive.
According to the supplied watchTowr account, the modern .mobi WHOIS service had already moved from `whois.dotmobiregistry.net` to `whois.nic.mobi` years earlier. The problem was not the official migration itself. The issue was that older software and hardcoded configurations still pointed at the retired address, and the old domain had been allowed to lapse. Once watchTowr bought it, those stale references effectively redirected historical trust in the legacy hostname to a private party.
The researchers said they stood up the replacement WHOIS endpoint on August 30, 2024 and quickly began seeing activity from a surprisingly broad set of systems. By September 4, they reported about 2.5 million queries and more than 135,000 unique systems connecting to the service. That scale matters because WHOIS is often treated as ancient plumbing: rarely discussed, rarely modernized, and assumed to be low-risk so long as it remains reachable. The experiment suggested otherwise.
The most serious consequence described in the evidence packet involved certificate issuance. watchTowr said some certificate authorities were still using WHOIS-based domain email validation for .mobi names and were consulting the researchers' server to determine where validation messages should be sent. The group said it tested that behavior with GlobalSign and was able to show that its own `whois@watchtowr.com` address could appear as the authoritative contact for `microsoft.mobi`. If accurate, that meant a neglected legacy hostname had become part of a chain of trust for validating control over domains.
The supplied evidence is also notable for what it says about old WHOIS tooling. watchTowr began the work while studying whether control of WHOIS responses could make long-known parsing bugs in clients exploitable in realistic conditions. In other words, the original research question was about remote code execution against vulnerable WHOIS clients. The broader incident emerged because the internet was still sending live traffic to a host that should have been irrelevant by then.
That combination of stale software, expired infrastructure and trust-dependent workflows is the core lesson of the case. The report does not claim that the researchers used the position to obtain fraudulent certificates or launch attacks. Instead, it shows that the preconditions existed because pieces of the ecosystem had not fully moved on from an earlier server name.
For operators, the story is a reminder that migrations are not finished when a new hostname goes live. They are finished only when dependent systems, libraries and validation processes stop consulting the old one. In the .mobi case, watchTowr's report suggests that assumption failed at internet scale, turning a forgotten domain into a live security exposure years after the formal changeover.
