“Effectively, we had inadvertently undermined the CA process for the entire .mobi TLD.”
The .mobi registry moved its WHOIS server and let the old domain expire. watchTowr bought it for $20 and logged 2.5 million queries from more than 135,000 systems, including government and military mail servers. GlobalSign parsed the fake record and offered a watchTowr address to verify microsoft.mobi. Certificate trust for a whole TLD hung on a domain nobody renewed.