sixthblog

Yesterday, reports surfaced claiming that GTBank had been hacked. According to the Daily Post, the bank's domain name had allegedly expired and was subsequently hijacked by hackers, leading to a massive phishing attack. However, earlier today, GTBank issued a statement refuting these claims, asserting that they were merely experiencing a connection issue and that there was no cause for alarm.

Given the conflicting reports, I decided to investigate the situation myself. Upon visiting the GTBank.com domain, it indeed appeared that the domain had expired. However, there was no concrete evidence to suggest that the domain had been hijacked. The rumor that GTBank's domain name was taken over by another entity seems to have originated from a screenshot circulating on Twitter below.

 This screenshot claimed that another entity had acquired the domain name, but a closer examination reveals that it lacks any direct connection to GTBank’s DNS information. The screenshot only displayed service provider details, without listing any specific domain name information, making it improper to draw conclusions based on that alone.

Further analysis of the screenshot showed that Perfect Privacy LLC was mentioned. This company is simply a cloaking service used to obfuscate the registration details of domain names. When a domain is registered, the registrant's information is typically available in the WHOIS database. Services like Perfect Privacy LLC help to secure this information by hiding it from public view. This does not indicate any hacking or malicious activity.

So, what’s the real issue here? It's most likely that GTBank did not enable auto-renewal for their domain name, leading to its expiration. When a domain expires, it can be leased out again. Some customers reported that they could still access the GTBank website, which suggests that the old website might be cached, allowing continued access for some users. Alternatively, GTBank may have quickly repurchased the domain, but the changes have not yet fully propagated across the internet, leaving some users unable to access the site.

This situation could have been avoided if GTBank had used a service that automatically renews domain names. It appears to be nothing more than an expiration issue, rather than a hacking incident.

I welcome any differing opinions or insights on this matter.