0

I'm looking for some domain name whose purpose is to act as a bogus malicious/suspicious/untrusted website or endpoint to be used as an example or in documentation.

IANA has reserved example.com for general purpose, is there an "evil" counterpart run by any organization? Something like "suspicious-website.com" or anything else with an obviously malevolent domain name ?

15
  • Nitpick: "ICANN has reserved example.com for general purpose". No it is the IETF doing that, not ICANN. See RFC2606 written almost before ICANN ever started to exist. Jan 11 at 16:16
  • Anything .example is reserved in RFC 2606. You could do malicious-website.example. I've seen evil.com used, but that appears to be an actual website. Jan 11 at 16:17
  • "is to act as a bogus malicious/suspicious/untrusted website" This is subjective, not technical. Contrary to reserving example.com which is uniform, labeling a website as "untrusted" is a subjective measure coming from one specific provider. Saying otherwise: depending on WHO you ask you may get data back that a domain/website is trusted or not. So for your question you need to ask it to the provider you are using to label websites, you don't mention which one. "obviously malevolent domain name" I would be curious to see how you define "obviously malevolent"... just because of the name? Jan 11 at 16:18
  • Do you need the domain to work?
    – schroeder
    Jan 11 at 16:37
  • 1
    "Yes but I need it to resolve. And if possible not to log every data it will receive." This is completely new requirements you did not put in your question, and you should. This is completely different from "a name being malicious". You can never fully know what the other end logs or not, so if you want this full control you have to do things by yourself, hence create the name you want and make sure it behaves as you need. Also, why you need a second domain? If you have any foobar.example domain name already, no need to buy another one, just use i-am-evil.foobar.example Jan 11 at 20:35

2 Answers 2

3

if some company or organization already runs one, i'd rather use that

I'm not sure that's a good idea. The benefit of example.com is that it is standardized. You can be reasonably certain that it will not change. It will not disappear, it will not start logging requests (if you trust the IANA), it will not serve actually malicious content, etc.

You can't do that for any random domain from some random company.

Though if that doesn't matter to you, you could use any of the existing evil.[com/org/etc] domains.

I'd recommend against it though. Alternative ideas:

  • use example.net or example.org (both are reserved according to rfc2606). Spell it out that .net/.org is "evil" and .com is "good".
  • use any of the reserved tlds (.test, .example, .invalid, .localhost). Eg evil.example. They won't resolve, but it may be good enough for you.
  • use a fake subdomain of the reserved example.com domain. Eg good.example.com vs evil.example.com (but again, they will not resolve).

The benefit of any of these is that you can be relatively sure that they will remain as they are (as they are reserved domains/tlds).

2
  • Well that was the purpose of my question. Is there some standardized domain for this purpose maintained by an official organisation? Or at least by a recognized security company which can be trusted (enough)? If not, then I would stick with example.com
    – Bastien
    Jan 11 at 17:37
  • 1
    @Bastien No, afaik there is no such thing. There is nothing in the relevant rfcs 2606 or 6761, the IANA page on reserved domains, or anything else that comes close to a standardization (that I'm aware of).
    – tim
    Jan 11 at 20:55
0

I have seen the TLD .evil used. It's not an official TLD, so it won't work.

So:

  • gmail.evil
  • paypal.evil
  • etc.evil

There may be a chance that it might be added in the future, so I'm not sure how future-proof it might be.

3
  • It doesn't exist in IANA root zone today. It could exist tomorrow, through normal mechanisms, and then you created an ambiguity. RFC2606 puts aside .example as TLD to play with, and some others, and there is no reason to invent any other new TLD. Plus, depending on where you plug the name, software may have trouble understanding it is a TLD and hence considering the name to be relative to some base domain name, instead of absolute from the root, so many operational issues can arrive. So in short no advantages and many disadvantages. Jan 11 at 20:33
  • Yep, and I mentioned the downsides. I mention it merely as something I have seen done.
    – schroeder
    Jan 11 at 21:55
  • Yes, there are a lot of things having been done, but not all of them are good ideas :-) Again, even if you put aside the "may be used later", there is the other part: some systems might test the TLD and not seeing it official, consider the full name to be relative and not absolute. Which can create all sorts of havoc. Jan 12 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.