“anyone who enters that email@domain in the squarespace form now has full access to control to the domain.”
Squarespace bought roughly 10 million domains from Google Domains and migrated them into half-built accounts with no password and no email verification. Anyone who knew the admin address could sign up first and take the domain. Crypto firms lost theirs to phishing redirects between July 9 and July 12. Squarespace blamed “a weakness related to OAuth logins.” Google sold its customers and Squarespace left the door unlocked.