Expired Startup Domain Purchase Leads to Unexpected AWS Root Account Access

The author purchased an expired domain that once belonged to a startup. Shortly after the acquisition, they found that the domain’s DNS records still pointed to an AWS account. Access to the AWS account was possible because the root credentials were stored in the domain’s configuration files. The inherited AWS root account gave control over the former startup’s cloud resources. The author examined the resources and identified several active services still running. They reported the findings to the former owners and to AWS for remediation. The incident highlights risks associated with abandoned domains and lingering cloud credentials. It serves as a reminder to audit and revoke access when decommissioning services.