DDoSecrets.com is gone: domain squatter snatched the URL, the project migrates to .ORG

DDoSecrets, a major whistleblower website, successor to WikiLeaks, has moved to a new domain, ddosecrets.org. The migration was forced after the old .com domain was lost due to registrar mishaps. DDoSecrets urges users to update all links and email addresses to the .org domain immediately.

DDoSecrets (Distributed Denial of Secrets) has been a major source for news leak. Recently it helped investigations on the white supremacist dating website WhiteDate, “Tinder for Nazis,” and exposed leaked data on backers of the UK Free Speech Union.

Since its founding in 2018, the site has hosted some of the largest data releases in history, such as the BlueLeaks law enforcement database, the Hacking Team, Stratfor leaks, and a 410 GB database of leaked messages from TeleMessage, a hacked Signal-clone messenger used by former US National Security Advisor Mike Waltz.

However, recently, the DDoSecrets website went blank, displaying only a message that the domain is for sale. The domain has been intentionally pointed to ParkingCrew, a commercial domain parking service helping owners to monetize or sell their URLs.

An unknown actor has taken control of the .com domain, and the original DDoSecrets team warns that any communications from the old domain should be considered illegitimate.

What happened?

“Our domain registration lapsed on January 28th. Our domain registrar had invalid contact information, and so we were not notified that domain auto-renewal had failed until they released the domain name and it was purchased by a domain squatter,” the team explained in a blog post.

A domain squatter is someone who hunts for web addresses about to expire, usually hoping to sell them for profit.

To the organization’s knowledge, no services have been used maliciously using the old domain, and no emails have been sent from the old addresses.

“Please switch all links and email addresses from .com to .org right away. If you receive any email from an @ddosecrets.com address it is illegitimate,” DDoSecrets warns the users.

“Please contact us immediately by Signal or social media and let us know if you receive email from our old domain. Our Signal and Cwtch contacts and onion addresses remain unchanged.”

The team also assures that the user data, the publicly published, and limited distribution data have not been compromised, and other services, including Globaleaks and libraryofleaks.org, remain online and intact.

Have thoughts about this topic? Others do, too. Join them in the discussion.

Old logins requiring hardware credentials will need to be renewed, however, existing username and password combinations on all the servers are secure and unchanged.

WHOIS data shows that ddosecrets.org was registered on December 7th, 2025, and it will not expire until December 7th, 2030. The nameservers point to Cloudflare, and protections prevent the domain from being deleted, transferred, or updated without authorization.

Unlock more exclusive Cybernews content on YouTube.