As part of its criminal case against Megaupload, the U.S. Government seized several domain names belonging to Kim Dotcom's file-hosting service. Nearly five years later the authorities still control the domains but they haven't done a very good job of securing them. Megaupload.org now links to a soft porn portal.

Megaupload was shutdown nearly half a decade ago, but all this time there has been little progress on the legal front.

Last December a New Zealand District Court judge ruled that Kim Dotcom and his colleagues can be extradited to the United States to face criminal charges, a decision that will be appealed shortly.

With the criminal case pending, the U.S. Government also retains control over several of the company’s assets.

This includes cash, cars, but also over a dozen of Megaupload’s former domain names, including Megastuff.co, Megaclicks.org, Megaworld.mobi, Megaupload.com, Megaupload.org, and Megavideo.com.

Initially, the domains served a banner indicating they had been seized as part of a criminal investigation. However, those who visit some of the sites today are in for a surprise.

This week we discovered that Megaupload.org is now hosting a site dedicated to soft porn advertisements. Other seized domains are also filled with ads, including Megastuff.co, Megaclicks.org, and Megaworld.mobi.

Megaupload?

Interestingly, this all happened under the watch of the FBI , which is still listed as the administrative and technical contact for the domain names in question.

So how can this be?

Regular readers may recall that something similar happened to the main Megaupload.com domain last year. At the time we traced this back to an expired domain the FBI used for their nameservers, Cirfu.net.

After Cirfu.net expired, someone else took over the domain name and linked Megaupload.com to scammy ads. The U.S. authorities eventually fixed this by removing the nameservers altogether, but it turns out that they didn’t do this for all seized domains.

A few weeks ago the Cirfu.net domain expired once more and again it was picked up by an outsider. This unknown person or organization parked it at Rook Media, to generate some cash from the FBI-controlled domains.

As can be seen from the domain WHOIS data, Megaupload.org still uses the old Cirfu.net nameservers, which means that an outsider is now able to control several of the seized Megaupload domain names.

The ‘hijacked’ domains don’t get much traffic but it’s still quite embarrassing to have them linked to ads and soft porn. Commenting on our findings, Kim Dotcom notes that the sloppiness is exemplary of the entire criminal case.

“Their handling of the Megaupload domain is a reflection of the entire case: Unprofessional,” Dotcom tells us.

What’s clear is that the U.S. authorities haven’t learned from their past mistakes. It literally only takes a few clicks to update the nameserver info and reinstate the original seizure banner. One would assume that the FBI has the technical capabilities to pull that off.