A domain name is an identification string that defines a realm of administrative autonomy, authority, or control on the Internet. Domain names are formed by the rules and procedures of the Domain Name System (DNS). Technically, any name registered in the DNS is a domain name.

learn more… | top users | synonyms

43
votes
4answers
10k views

Is publishing your public IP address a security threat?

I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably ...
28
votes
3answers
17k views

How do hacking groups register domains remaining anonymous?

Let's take lulzsec as an example; they registered lulzsecurity.com. There are two problems that I don't understand how they solved: They had to pay for it. Tracking down money is generally much ...
24
votes
3answers
971 views

What are some risks of purchasing a “used” domain name

If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
22
votes
3answers
5k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
22
votes
5answers
30k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
18
votes
2answers
920 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
17
votes
1answer
2k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
16
votes
6answers
9k views

Is showing your IP address in the URL a bad practice?

Someone told me that showing your IP address in a URL (like hxxp://45.67.134.34/default.html) is easier to hack. Is that true? I could trace any domain name and get its IP number as well.
14
votes
3answers
283 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
10
votes
3answers
5k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
10
votes
2answers
358 views

How to protect against exploitation using a lapsed domain

Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
10
votes
4answers
783 views

How to stop/detect someone else registering a certificate for my domain

With the proliferation of low-cost automated CAs what can be done to mitigate the attack of someone doing a spear phishing attack to get a login to our webmail system, then using an automated service ...
10
votes
1answer
575 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
8
votes
2answers
693 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
7
votes
2answers
1k views

How can I stop someone from displaying my website on his domain?

I just discovered that someone is pointing their domain name to the server I use for a website, which results in traffic to their domain displaying the content of my website. How can I stop this ...
7
votes
1answer
226 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
6
votes
2answers
569 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
6
votes
3answers
301 views

Does domain privacy make a domain less secure?

Does buying domain privacy make the domain more secure against hijacking? Would it make the domain less secure against losing it, if the registar gets bankrupt? I am afraid that the domain could be ...
6
votes
2answers
9k views

Malicious users trying to create yahoo accounts with random emails at my domain?

Recently, I have been getting a string of emails from yahoo with people trying to create accounts or add email addresses @mydomain.tld to their account. I was wondering if anyone else has seen this ...
5
votes
1answer
96 views

How does the “Privacy Protection” option from domain names registrars work?

Some domain names registrars are offering a "Privacy Protection" option to hide your registrant details. Your whois infos will then refer to the "privacy company" providing this service instead of the ...
4
votes
3answers
1k views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( "...
4
votes
1answer
4k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
4
votes
2answers
460 views

Is it safe to point a (sub)domain to my home IP address?

I have my own website and I created a subdomain that points to my home IP address. It is useful for personal things like entering my domain for wake-on-lan and letting my friends enter it to join ...
4
votes
3answers
3k views

Keeping Whois domain registration details private

Most domain registers offer a service to keep your details private in the Whois database. Usually this works by replacing your email, telephone and snailmail addresses with proxies or P.O. Box numbers....
4
votes
1answer
52 views

How does a Registrar/Domain Lock increase security?

I have all of my domains locked, so that they cannot be transferred without first unlocking. However, I can't think of any scenario where this lock increases security. In order to transfer, one must ...
3
votes
3answers
339 views

Domain Name Thefts

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). ...
3
votes
1answer
281 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
3
votes
2answers
657 views

Is it reasonable to keep control panel in separate subdomain or domain?

Since I'm quite beginner to information and websites security, I'd like to ask more experienced people about and idea, that just crossed my mind (probably isn't my original discovery! :]). With ...
3
votes
1answer
125 views

Email, Certificates and DANE [closed]

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
3
votes
2answers
781 views

How can I protect my domain names without exposing too much personal information?

I guess more specifically I want to know how to ensure I retain ownership by having sufficient contact information in the Administrative, Technical and Billing contact fields, but without exposing too ...
2
votes
3answers
507 views

Strange unsolicited email sent to almost never used email address

What initially looked like typical spam now seems extra odd and is bugging me (only figuratively I hope). Ostensibly, a sales rep from DomainNameSales.com (DNS), which I'd never heard of, sent an ...
2
votes
5answers
291 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
2
votes
2answers
748 views

How to find out the email host of a vanity email address?

Assuming a person gets his own domain address, say, theperson.com. He then goes on to create a vanity email address with that domain. e.g. me@theperson.com. me@theperson.com may be hosted by the ...
2
votes
1answer
75 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
2
votes
2answers
2k views

How could you find wildcard subdomains on websites?

Other than testing different URLs separately, is there anyway to find out if a website has a wildcard sub domain?
2
votes
1answer
169 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
2
votes
1answer
663 views

Using cookies for cross domain authentication

I have an web app 1 which would do the authentication of the user. After that I want to forward the request to another web app 2. Now web app 1 will generate some hashcode which I can authenticate in ...
2
votes
2answers
52 views

DNS Domain Issue [closed]

we are maintaining our DNS account to GODaddy DNS Provider for our servers, Right now we have an problem, If some one have to register domain or sub-domain from any of other dns provider or godaddy ...
2
votes
2answers
314 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
2
votes
0answers
72 views

How bad is it to configure a public webhook service to use the server’s farm private dns server?

For those who ignore it, webhooks is a service that you configure with a web interface for sending post http requests to a configured url. Those services are sometimes offered by public sites like ...
1
vote
3answers
135 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
1
vote
2answers
253 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: http://wiki....
1
vote
1answer
99 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
1
vote
1answer
146 views

Force DNS to attach bad IP address

The question is not professional, but what I'm trying to say is... Is there any way to inject or force the DNS server to attach/change an IP address for some site. For example, I'm running an apache ...
1
vote
1answer
101 views

DNS Redelegation - Security Risk?

I am a web developer and I use Adobe Business Catalyst. To use some of their services it is recommended you redelegate the domain. In other words change the nameservers to Business Catalyst. I have ...
1
vote
1answer
97 views

How can I contract an email tracking service and be silent about it?

I use a customized e-mail and my web-master, who is also the domain owner, doesn't allow me to see the settings that the DNS provides. Some DNS services provide, beside domain name registration, ...
1
vote
2answers
93 views

How do web hosts know you own your domain?

Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend: Second, we add some ...
1
vote
2answers
103 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
1
vote
1answer
41 views

What are the real risks of enabling unsecure DNS updates on Active Directory intranet domain?

Based on my current research, enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN. While this works fine for Windows machines ...
1
vote
1answer
390 views

Root/Naked domain and DDOS

Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s). What so special about the root domain concerning the DDOS attacks? [1] http://...