Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

AmplifAI (GoDaddy instance)


Group Whitearmor New Group
Discovered 2026-11-01 13:58 UTC
Est. attack date 2026-11-01
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation
This is an emerging group, so this claim should be treated with caution until independently verified.

Description:

GoDaddy AmplifAI Instance — Complete Data Dump ================================================ URL: https://godaddy.ampbi.net Okta SSO: https://godaddy.okta.com Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI) Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7 ============================================================ USER DATABASE — 13,565 unique employees ============================================================ File: all_users.json Fields per user: "name": "", "email": "", "userseq": , "firstname": "", "lastname": "", "ad_id": "", "password": "", "aduser": "true/false", "usertype": "1/2/3/4", "employeenumber": "" User Type Key: 1 = Admin 2 = Manager 4 = Agent Breakdown: Total users: 13,565 AD users (Okta/SSO): 6,184 Non-AD users (local): 16 Admins (type=1): 459 Managers (type=2): 502 Agents (type=4): 5,239 Default password: [REDACTED] Non-default passwords: 9 ============================================================ ORGANIZATIONS — 34 total ============================================================ 1. Agent Dashboard – Organizations 1. DEM Sales_Support - ALL 2. DEM Sales_Support - GDDY 3. DEM Sales_Support - TP 4. GD International Independents 5. GD US Independents 6. Commerce - GDDY 7. Commerce - TP 8. DEM Sales_Support - SGS 9. EMEA Brands - ALL 10. EMEA Brands - GDDY 11. EMEA Brands - TP 12. GAO - GDDY 13. GD Teleperformance 14. Global Messaging Ops - GDDY 15. Global Messaging Ops - Genpact 16. Global Messaging Ops - SGS 17. Global Messaging Ops - TP 2. Performance Dashboard – Organizations 18. ROW Sales_Support - ALL 19. ROW Sales_Support - Genpact 20. ROW Sales_Support - SGS 21. Services - SGS 22. US Sales_Support - SGS 3. Analytics – Organizations 23. Global Messaging Ops - ALL 24. ROW Sales_Support - TP 25. Services - ALL 26. Services - GDDY 27. Services - TP 28. US Sales_Support - ALL 29. US Sales_Support - GDDY 4. Non Core Care – Organizations 30. US Sales_Support - TP 31. Non Core Care - GDDY 32. Non Core Care - Genpact 33. Non Core Care - SGS 34. Non Core Care - TP ============================================================ LOGIN LOGS — 4,451 records ============================================================ File: login_logs.json Fields per record: "Name": "", "Title": "", "Module": "", "Access Date": "", "Access Time": "", "Time Zone": "", "Access Device": "", "Primary Program": "", "Organization": "", "Location": "", "Manager Name": "", "OpsManager Name": "" Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy Sample devices: Desktop, Mobile ============================================================ ROSTER DATA — 1,201 records (1,193 with @godaddy.com emails) ============================================================ File: roster.json Fields per record: "RosterExportID": "", "companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8", "employeeid": "", "email": "", "fname": "", "lname": "", "managerid": "", "pbxid": null, "location": "", "primaryprogram": "", "title": "", "recorddate": "", "hiredate": null, "termdate": null, "loginuserid": "", "customfield1": null, "customfield2": null, "customfield3": null, "customfield4": null, "customfield5": null, "customfield6": null, "customfield7": null, "customfield8": null, "customfield9": null, "customfield10": null, "otherprogram1": null, "otherprogram2": null, "otherprogram3": null, "otherprogram4": null, "otherprogram5": null, "otherprogram6": null, "otherprogram7": null, "otherprogram8": null, "otherprogram9": null, "otherprogram10": null, "varcharemployeeid": "", "varcharmanagerid": "", "organization": "", "movedToCosmos": "False", "glidepathtitle": null, "gltitleid": null, "coach": null, "programstartdate": null, "RequestID": "" Roster by Organization: US Sales_Support - GDDY: 405 records Global Messaging Ops - Genpact: 191 records EMEA Brands - GDDY: 176 records Commerce - GDDY: 135 records DEM Sales_Support - GDDY: 103 records ROW Sales_Support - SGS: 101 records Commerce - TP: 41 records Non Core Care - Genpact: 37 records Services - TP: 12 records ---------------------------------------- TOTAL: 1,201 records 25 organizations have no roster data available. ============================================================ PROGRAMS — 227 unique GoDaddy call center programs ============================================================ File: programs.json Categories include: Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin) Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS Geographic: UK & IE, CA & AU, LATAM, EMEA, International English Security: Website Security Sales I/II, Website Security Support Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services ============================================================ OKTA / ACTIVE DIRECTORY INTEGRATION ============================================================ Okta Tenant: https://godaddy.okta.com AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7) Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta) SAML SSO: SAML 2.0 OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration Authn API: POST https://godaddy.okta.com/api/v1/authn (accepts JSON {username, password}, returns sessionToken on success) Password Grant: Supported (grant_type=password in OIDC config) AD User Identity Format: "Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin) Okta accepts: username, [REDACTED]@godaddy.com, EMAIL format Reach out on session or be the next headline https://getsession.org ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c


Leak Screenshot:

Leak Screenshot

Other recent victims