PULSE
FEED
ransomqilin reclama a Global Holding · Otherransomwhitearmor reclama a AmplifAI (GoDaddy instance) · US · Technologyransomdirewolf reclama a My Cloud Grocer · GB · Retail & E-Commerceransomhyflock reclama a hitech group · US · Technologyransomqilin reclama a Shibata Co., Ltd. · JP · Manufacturingransomqilin reclama a Meshbesher & Spence · US · Professional Servicesransomqilin reclama a BKV Vasúti Jármjavító Kft · HU · Transportationransomqilin reclama a Forum · AT · Professional Servicesransomqilin reclama a Select Community Management · US · Professional Servicesransomqilin reclama a CMD Naturkosmetik · DE · Retail & E-Commerceransomqilin reclama a qc-consult · DE · Professional Servicesransombarracuda reclama a EVINOKS · TR · Technologyransomqilin reclama a Danser · US · Otherransomvexy ransomware reclama a System Soft · BG · Technologyransomqilin reclama a Global Holding · Otherransomwhitearmor reclama a AmplifAI (GoDaddy instance) · US · Technologyransomdirewolf reclama a My Cloud Grocer · GB · Retail & E-Commerceransomhyflock reclama a hitech group · US · Technologyransomqilin reclama a Shibata Co., Ltd. · JP · Manufacturingransomqilin reclama a Meshbesher & Spence · US · Professional Servicesransomqilin reclama a BKV Vasúti Jármjavító Kft · HU · Transportationransomqilin reclama a Forum · AT · Professional Servicesransomqilin reclama a Select Community Management · US · Professional Servicesransomqilin reclama a CMD Naturkosmetik · DE · Retail & E-Commerceransomqilin reclama a qc-consult · DE · Professional Servicesransombarracuda reclama a EVINOKS · TR · Technologyransomqilin reclama a Danser · US · Otherransomvexy ransomware reclama a System Soft · BG · Technology
Ransomware · Claim1 noviembre 2026 · 13:58 UTC
CLAIMreclamada porWHITEARMOR

AmplifAI (GoDaddy instance)

PaísUSUnited States
SectorTechnology
Datos claveREGISTRO
Monto de rescateNo revelado
Tamaño de datos exfiltradosNo revelado
Screenshot del leakSí
Prensa mencionada por el grupoNo
Descripción

GoDaddy AmplifAI Instance — Complete Data Dump ================================================ URL: https://godaddy.ampbi.net Okta SSO: https://godaddy.okta.com Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI) Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7 ============================================================ USER DATABASE — 13,565 unique employees ============================================================ File: all_users.json Fields per user: "name": "", "email": "", "userseq": , "firstname": "", "lastname": "", "ad_id": "", "password": "", "aduser": "true/false", "usertype": "1/2/3/4", "employeenumber": "" User Type Key: 1 = Admin 2 = Manager 4 = Agent Breakdown: Total users: 13,565 AD users (Okta/SSO): 6,184 Non-AD users (local): 16 Admins (type=1): 459 Managers (type=2): 502 Agents (type=4): 5,239 Default password: 13,510 Non-default passwords: 9 ============================================================ ORGANIZATIONS — 34 total ============================================================ 1. Agent Dashboard – Organizations 1. DEM Sales_Support - ALL 2. DEM Sales_Support - GDDY 3. DEM Sales_Support - TP 4. GD International Independents 5. GD US Independents 6. Commerce - GDDY 7. Commerce - TP 8. DEM Sales_Support - SGS 9. EMEA Brands - ALL 10. EMEA Brands - GDDY 11. EMEA Brands - TP 12. GAO - GDDY 13. GD Teleperformance 14. Global Messaging Ops - GDDY 15. Global Messaging Ops - Genpact 16. Global Messaging Ops - SGS 17. Global Messaging Ops - TP 2. Performance Dashboard – Organizations 18. ROW Sales_Support - ALL 19. ROW Sales_Support - Genpact 20. ROW Sales_Support - SGS 21. Services - SGS 22. US Sales_Support - SGS 3. Analytics – Organizations 23. Global Messaging Ops - ALL 24. ROW Sales_Support - TP 25. Services - ALL 26. Services - GDDY 27. Services - TP 28. US Sales_Support - ALL 29. US Sales_Support - GDDY 4. Non Core Care – Organizations 30. US Sales_Support - TP 31. Non Core Care - GDDY 32. Non Core Care - Genpact 33. Non Core Care - SGS 34. Non Core Care - TP ============================================================ LOGIN LOGS — 4,451 records ============================================================ File: login_logs.json Fields per record: "Name": "", "Title": "", "Module": "", "Access Date": "", "Access Time": "", "Time Zone": "", "Access Device": "", "Primary Program": "", "Organization": "", "Location": "", "Manager Name": "", "OpsManager Name": "" Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy Sample devices: Desktop, Mobile ============================================================ ROSTER DATA — 1,201 records (1,193 with @godaddy.com emails) ============================================================ File: roster.json Fields per record: "RosterExportID": "", "companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8", "employeeid": "", "email": "", "fname": "", "lname": "", "managerid": "", "pbxid": null, "location": "", "primaryprogram": "", "title": "", "recorddate": "", "hiredate": null, "termdate": null, "loginuserid": "", "customfield1": null, "customfield2": null, "customfield3": null, "customfield4": null, "customfield5": null, "customfield6": null, "customfield7": null, "customfield8": null, "customfield9": null, "customfield10": null, "otherprogram1": null, "otherprogram2": null, "otherprogram3": null, "otherprogram4": null, "otherprogram5": null, "otherprogram6": null, "otherprogram7": null, "otherprogram8": null, "otherprogram9": null, "otherprogram10": null, "varcharemployeeid": "", "varcharmanagerid": "", "organization": "", "movedToCosmos": "False", "glidepathtitle": null, "gltitleid": null, "coach": null, "programstartdate": null, "RequestID": "" Roster by Organization: US Sales_Support - GDDY: 405 records Global Messaging Ops - Genpact: 191 records EMEA Brands - GDDY: 176 records Commerce - GDDY: 135 records DEM Sales_Support - GDDY: 103 records ROW Sales_Support - SGS: 101 records Commerce - TP: 41 records Non Core Care - Genpact: 37 records Services - TP: 12 records ---------------------------------------- TOTAL: 1,201 records 25 organizations have no roster data available. ============================================================ PROGRAMS — 227 unique GoDaddy call center programs ============================================================ File: programs.json Categories include: Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin) Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS Geographic: UK & IE, CA & AU, LATAM, EMEA, International English Security: Website Security Sales I/II, Website Security Support Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services ============================================================ OKTA / ACTIVE DIRECTORY INTEGRATION ============================================================ Okta Tenant: https://godaddy.okta.com AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7) Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta) SAML SSO: SAML 2.0 OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration Authn API: POST https://godaddy.okta.com/api/v1/authn (accepts JSON {username, password}, returns sessionToken on success) Password Grant: Supported (grant_type=password in OIDC config) AD User Identity Format: "Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin) Okta accepts: username, username@godaddy.com, EMAIL format Reach out on session or be the next headline https://getsession.org ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c

Otras víctimas del grupo · ±48h2
HaceVíctimaPaísSectorTamañoCap.
1d
Gamdom V2
—Other—●
2d
KTU Shipyard
PHTransportation—●Philippines