Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Ernesto domain name registrations up - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Ernesto domain name registrations up

Today we noted a spike in registrations of domains with the term "Ernesto". No surprise given the approaching hurricane by that name. Today, 19 new "Ernesto" domains became live. One of them is just the name of a person and not hurricane related. The other 18 are hurricane related. 17 of these domains are registered by one person.

Today's Names:

Last year, we had a big number of fraudulent sites asking for donations for Katrina victims. We are afraid that similar issues may arise this year. At this point, the domain names listed above are parked. We will keep an eye on them. Let us know if you find any donation-fraud sites.

Graph of "Ernesto" domain registrations:
(click for full size)


The person who registered most of these domains wrote to say this:

Tell me why I deserve this, or at least help me recover as I have spent hours, barely slept in order to get good news about that situation. I lived on the Gulf Coast, my grandfather's mosoleum was destroyed by Katrina, as well as his house and many family and friends homes and properties.

Yes, I have other domains for sale. This is America, this is capitalism. People buy real estate often with the intent of bettering it and selling it. I own, b/c this is obviously a company that can cover this better than me.

Please, it is really painful to deal with this situation when all I could be putting up valuable information. Annd then, using money earned to build a nice company that will be very beneficial to a lot of people (

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS London June 2022


4479 Posts
ISC Handler
Aug 29th 2006

Sign Up for Free or Log In to start participating in the conversation!