$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks