Login is itself an XML command so in theory that could also be hacked. Like @silisili said most of the registry operators require client certs and ips to go wi

Login is itself an XML command so in theory that could also be hacked. Like @silisili said most of the registry operators require client certs and ips to go with the usernames but it is very possible that they are only checking that after getting a login. CoCCA run by the tiny zones with no budgets. They are likely to be VERY vulnerable to this.