“Eclypsium researchers estimate there are currently about one million Sitting Duck domains, and that at least 30,000 of them have been hijacked for malicious use since 2019.”
Krebs wrote about this exact hole at GoDaddy in 2019, and Matthew Bryant described it three years before that. About a million domains are still claimable by anyone who opens a free account at the right DNS provider. At least 30,000 have been hijacked, including one registered by the Anti-Phishing Working Group. The fix is checking who owns the domain, and the providers still skip it.