Hundreds of hacked GoDaddy domain name accounts are being used as part of a campaign using the Angler exploit kit. The attackers are using the accounts to create subdomains that shuttle Web surfers to websites hosting Angler. The owners of the accounts are usually unaware of the activity, which Cisco calls “domain shadowing” Nearly a third of the domain names on the Internet are registered through GoDaddy, an official with Cisco Systems says. The accounts are likely compromised by stealing the login credentials through phishing attacks.”]
Source: https://www.csoonline.com/article/2892327/driveby-attack-relies-on-hacked-godaddy-accounts.html