1

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario.

My question is what are the risks when another domain successfully points to your server?

  • For me, it's a questionable point: why should you serve such requests as valid HTTP ones? (with 404, or 301, or whatever response). Doing so, you're a part of the routing for this domain, and this may cost you something, sooner or later. Why not just drop such requests and close associated connections? – Yury Schkatula Nov 13 '19 at 14:19
  • Are you recommending I return with 444 in my nginx config, instead of 404? – Anonona Nov 13 '19 at 14:23
  • Just drop the connection and ignore the request. – Yury Schkatula Nov 13 '19 at 14:37
  • (which I did by returning 444) – Anonona Nov 13 '19 at 14:39
3

There are a number of risks, for both you and (assuming it was a mistake) the domain owner.

For you, it means at least exposure. In some cases, that can mean more DDOS attacks. If the domain owner had some issues with hackers, that may come to your website too.

If the domain that erroneous points to you is blacklisted somewhere, that blacklist could in some circumstances extend to your IP address (depending on who does the blacklisting).

It is possible that some DNS registrar contacts you with an invoice. You should not need to pay that, but it is again an annoyance.

That is more or less the list of risks I can think of.

For the domain owner, it effectively means that you are now in a position to do a MITM attack on him. For him, that is a serious risk. The domain owner should at least be grateful for your 404-serving approach.

  • Concise answer, thanks. But why should they be grateful? Surely I'm just MITM of my own website. I was more concerned they were trying to MITM me... – Anonona Nov 13 '19 at 14:13
  • You are in a position to do a MITM for their website. Sure, it will take some effort to find their IP address, but it is still possible. You could also have served undesirable content, thereby harming their business, so, yes, if it was a config mistake, they should be grateful. – Ljm Dullaart Nov 13 '19 at 15:25
  • Okay, thanks for the info. – Anonona Nov 13 '19 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.