Cyber Security
From DNS Blocks to Registrar Holds: What Happened to caghi[.]com and cari[.]report After June 2026
A follow-up on the lookup sites behind Malaysia's June 2026 data-leak claims. Public registry records show both caghi[.]com and cari[.]report were suspended by their registrars after the MKN statement, years after a DNS block failed. What changed, what did not, and why "OSINT" was the wrong label.
Akmal Alif · 10 October 2026 MYT
Editorial and privacy note
This is our third report on personal-data lookup sites targeting Malaysians. It follows our September report on the lookup case and our follow-up on three incidents from June to September 2026.
EXEPERT did not visit, search, buy from or download anything from either site. Everything below comes from three things:
official statements and news reports;
public domain-registry records (RDAP);
the Internet Archive's index of when pages were captured.
For one site, we also read only the title and description its own landing page published, as stored by the Internet Archive.
No personal data appears in this report. The domains are written "defanged", with brackets, and are not linked.
The official statement
On 21 June 2026 the National Security Council (MKN) said that personal-data leak claims circulating on social media involved information believed to come from cybersecurity incidents before 2022. It said the claims were not linked to any current platform (Bernama, 2026). The statement included these points:
NACSA's view. The National Cyber Security Agency believed the data had been obtained illegally through intrusions into various systems. It was now being shared online without authorisation.
Using such services is an offence. Providing, sharing or granting access to unlawfully obtained information is an offence under Malaysian law, even when the service is hosted abroad.
Takedowns were under way. NACSA, MyNIC and the Personal Data Protection Department had taken immediate steps, including engaging foreign service providers to remove and block the websites involved.
Police were investigating. NACSA was working with the Royal Malaysia Police on digital-forensic investigations.
New law was coming. The Cyber Crime Bill would criminalise unauthorised access to computer systems and identity theft.
MyDigital ID is not a data store. The council said MyDigital ID, with more than 16 million registrations, does not store personal data.
The statement did not name any website. The posts that made the claims go viral did.
Two sites, one pattern
caghi[.]com: blocked in 2022, still reachable for years
The government has said the Malaysian Communications and Multimedia Commission (MCMC) blocked access to caghi[.]com in June 2022. In September 2025, Communications Minister Fahmi Fadzil said it had been blocked since then, but a version still appeared to be active. MCMC was working with service providers to identify the people behind it. That followed a viral social-media post claiming the site exposed identity-card numbers, addresses, phone numbers, vehicle details and banking information (RTM, 2025).
In October 2025, in a written parliamentary reply, Digital Minister Gobind Singh Deo said the government was stepping up action against the sale of Malaysians' personal data on the dark web and on sites such as caghi[.]com. He said such sales had gone on for years and were expected to persist (New Straits Times, 2025).
The public records show why a June 2022 block did not end it:
Registration. The domain was registered on 22 December 2020 through Tucows (Verisign, 2026).
Captures after the block. The Internet Archive kept capturing the site, with "OK" responses, through 2023, 2024 and 2025 (Internet Archive, n.d.). MCMC blocks are carried out by Malaysian internet providers; the viral post below describes this one as a DNS block. Anyone outside Malaysia, or inside it using a different DNS resolver, could still reach the site.
The viral post. On 19 June 2026 a widely shared Threads post complained to ministers that leaked data on citizens and leaders was still on display. It said the DNS block was useless because a public DNS resolver got around it (belumsetel, 2026). The replies to that post refer to caghi by name.
The hold. The domain's registry record was last changed on 22 June 2026, the day after the MKN statement. It now carries the status "clientHold", with transfers and updates locked (Verisign, 2026). A client hold means the registrar has taken the domain out of the global DNS. The name no longer resolves anywhere, not only in Malaysia.
cari[.]report: "OSINT" as a sales pitch
The second domain is newer:
Registration. It was registered on 6 February 2026 through Namecheap, with its DNS on Cloudflare (Identity Digital, 2026).
Captures. The Internet Archive captured it three times: on 28 February, 7 March and 21 June 2026, the day of the MKN statement (Internet Archive, n.d.).
The hold. Its record was last changed on 11 August 2026, and it too is now on "clientHold" (Identity Digital, 2026).
Its own archived landing page describes what it sold. In February 2026 it called itself a "Malaysia OSINT Data Platform". It advertised unlimited searches of "public records" including MyKad numbers, phone numbers, addresses, vehicles and company information. By June the tagline had become a promise to search anyone in Malaysia by name, phone, vehicle or company (cari[.]report, 2026).
That framing deserves a direct answer. OSINT, open-source intelligence, means analysing information that is genuinely public. A database that returns a stranger's identity-card number and home address from a name or phone number is not a public record in any ordinary sense. Under Malaysian law, as NACSA said in June, giving access to unlawfully obtained data is an offence wherever it is hosted (Bernama, 2026).
The speakers in HackDev MY's Introduction to OSINT webinar made the same distinction: OSINT is legal only if you stay public. One speaker mentioned caghi by name and called it very dangerous (watch from 39:00).
We did not test either site and cannot say where cari[.]report's data came from. We can only say what it advertised, when it was online and when it stopped resolving.
What changed, and what did not
A registrar hold works where a DNS block does not. An ISP-level block changes what Malaysian resolvers answer. A registrar hold changes what the whole internet answers. The MKN statement said agencies were engaging foreign service providers. The registry records show both domains went on hold after that, one of them within a day. The records do not say who requested either hold, and we have not seen an official statement naming these two domains.
The data does not disappear with the domain. Holds remove a name, not a dataset. Our June-to-September follow-up explains why breached records keep circulating. The same data can reappear under a new name, in a messaging channel, or for sale elsewhere. In his October 2025 reply, Gobind said these sales were expected to persist.
The legal gap is narrowing. The Cyber Crime Bill described in June would make unauthorised access and identity theft offences in their own right. Under the Personal Data Protection Act amendments in force since 2025, organisations must report breaches.
What readers can do
Do not search yourself or anyone else on these services. Doing so is itself an offence, and paying them funds the next one.
Report rather than share. If you see a new lookup site, report it to MCMC or to CyberSecurity Malaysia's Cyber999 service. Do not post its address, and if you must refer to it, defang it as we have here.
Assume your MyKad number is known. Treat calls, messages and emails that quote your details as possible scams, and verify through official channels.
Watch for the "OSINT" label. Real OSINT education teaches you to protect your own footprint. A paid search box that returns other people's identity numbers is not OSINT.
References
belumsetel. (2026, June 19). [Post on leaked data of citizens and leaders, and DNS blocking] [Threads post]. Threads. https://www.threads.com/@belumsetel/post/DZwoGhZE5a3
Bernama. (2026, June 21). Viral data leak claims old incident, unrelated to current platforms: MKN. https://www.bernama.com/en/general/news.php?id=2571178
cari[.]report. (2026). [Landing-page title and description, captured 28 February and 21 June 2026] [Web page metadata]. Internet Archive. Not linked.
Identity Digital. (2026). RDAP record for cari[.]report [Registry data]. Retrieved October 10, 2026, through the registry RDAP service at https://rdap.identitydigital.services/rdap/
Internet Archive. (n.d.). Wayback Machine capture index for caghi[.]com and cari[.]report [Capture metadata]. Retrieved October 10, 2026. Not linked.
New Straits Times. (2025, October 23). Malaysia blocks caghi[.]com amid mass data leak concerns. https://www.nst.com.my/news/regional/2025/10/1300130/malaysia-blocks-caghicom-amid-mass-data-leak-concerns
RTM. (2025, September 10). MCMC sekat akses laman web caghi[.]com sejak 2022 [MCMC has blocked access to the caghi[.]com website since 2022]. Berita RTM. https://berita.rtm.gov.my/nasional/senarai-berita-nasional/senarai-artikel/mcmc-sekat-akses-laman-web-caghi-com-sejak-2022
Verisign. (2026). RDAP record for caghi[.]com [Registry data]. Retrieved October 10, 2026, through the registry RDAP service at https://rdap.verisign.com/com/v1/