Questions tagged [domain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
53 views

Is an IP not being redirected to it's associated domain considered unsecure?

I've got a server that has domain and an SSL Certificate issued to that domain. It's expected behavior that when an IP address is browsed, it redirects to the domain name of the server and the SSL ...
0
votes
1answer
48 views

.local domain any possible ways in getting the extension

I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host. ...
1
vote
1answer
92 views

Is it possible for a domain to be faked?

I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
0
votes
1answer
75 views

What is the list of known host domains where subdomains come from different providers?

I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do ...
1
vote
1answer
84 views

how can I find all the websites on a particular IP? [duplicate]

When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same ...
1
vote
1answer
109 views

Protecting a website from being kidnapped

I have a MediaWiki website in Hebrew; As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible. I chose to give that website a Global TLD (a non ...
3
votes
2answers
99 views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
0
votes
1answer
70 views

Why can I still receive email at my old domain after someone else bought it?

My domain expired years ago and was registered by another party. I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes. Now if someone buys ...
0
votes
1answer
50 views

Cookie domain security

Recently, I started diving into cookies, but as far as the domain property concerned I don't experience it as too be that straightforward. I've read this article: http://web.archive.org/web/...
0
votes
1answer
63 views

Point domain to IP address on Cobalt Strike [closed]

On Cobalt Strike how do I point a domain (in this case a subdomain) to the IP address to create a listener?
1
vote
0answers
20 views

How the information from different resources are used in calculating the reputation score of a domain name in whoisxml (domain reputation API)?

I'm trying to obtain the reputation score of a domain name from whoisxml. There are some resources listed in their website such as the website content and it relation to other domains, and host ...
1
vote
1answer
92 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
0
votes
0answers
75 views

Risks associated with developers using their own domain for development services

We have some development and test environments using our canonical domain, e.g. dev.example.com. We also use some services from 3rd party providers that have obscure URLs like xjkhasdkjvhas.dns.ashdfb....
0
votes
0answers
29 views

Is one top level domain more inherently secure than another? [duplicate]

There's an interesting discussion going on at work right now. Someone wants to move their app off a .com domain and put it on a .net domain. They contend a .net domain can provide the level of ...
2
votes
0answers
119 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
1
vote
1answer
112 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
1answer
170 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
0
votes
1answer
82 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
3
votes
4answers
378 views

Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth ...
0
votes
1answer
52 views

One domain using certificate of other domain [closed]

I recently Googled a website e.g A.com and found B.com in search result at the top. In reality A.com should be on top as B.com doesn't have anything in common or related to A.com but Google shows it ...
0
votes
1answer
82 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
0
votes
2answers
129 views

how one can find out sub-domains of a domain without brute-force?

I had to edit my original question after several answers were submitted. Original question was: how one can find out sub-domains of a domain without brute-force? is there a way to request a domain ...
0
votes
2answers
81 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
100
votes
8answers
23k views

Can someone read my E-Mail if I lose ownership of my domain?

Let's assume I have a server set up with an email address like me@mydomain.tld. Now I have distributed my business card with the e-mail address to all people all over the world and they keep sending ...
2
votes
2answers
298 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
1
vote
0answers
56 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
1answer
81 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
-1
votes
1answer
36 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
0
votes
1answer
215 views

Benign, Malicious Domains and Definitions

I am working on a research project where we segregate domains used for malicious purpose from benign domains. However, my guide does not want the term malicious domain and benign domain in the paper....
0
votes
3answers
163 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
1
vote
0answers
231 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
2
votes
2answers
87 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
0
votes
1answer
202 views

Domain SSL encryption from client to DNS Server

Im wondering why the domain name is not encrypted when a request do a DNS Server is made. As it seems this is the main weaknesses for internet users. I came to this when i heard that in germany ...
2
votes
2answers
96 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
80
votes
3answers
9k views

Possible reason for displaying two different websites on single domain?

This is something interesting. Try going to http://www.circaventures.com/ You will get a venture capital company. Now go to google and search "Circa Ventures". The first result you get is the exact ...
0
votes
1answer
87 views

Where or how can I get list of domain dependencies of top 100 popular sites? [closed]

For example google.com depends on ssl.gstatic.com, lh3.googleusercontent.com, fonts.gstatic.com. I need this list for Proxy settings
7
votes
2answers
1k views

Manage SSL certificates for a multi-tenant website

We have given customers the option to allow custom domains which ultimately point to our server by changing the CNAME. Some of our customers would like to have SSL enabled to their domain but I am ...
0
votes
1answer
2k views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
1
vote
1answer
180 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
1
vote
2answers
197 views

How do you prevent a computer in a network from accessing RDP?

So you're on a domain. I know that Remote Desktop needs an authorized user's credentials (e.g admin) to log in with a remote computer. But can you also place a condition that you need to be using a ...
5
votes
2answers
190 views

Is there a more secure way for users to log into the domain other than just passwords?

Say you have this: An NPS server that grants access to users using client certificates (EAP-TLS). So for example someone managed to snatch the domain administrator's password and they log in to the ...
1
vote
1answer
227 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
6
votes
2answers
683 views

How can Cloudflare determine the owner of a website?

Assume that we have two websites with two different owners. Both of them set their domain name server to john.ns.cloudflare.com and joly.ns.cloudflare.com. The first owner set both domains in his ...
1
vote
0answers
79 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
5
votes
3answers
1k views

Receiving lots of spam after registering a new domain on GoDaddy

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
4
votes
1answer
958 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
1
vote
1answer
916 views

Spam mail “is missing domain” [duplicate]

I just recieved a spam mail. They asked me to "confirm my amazon account / identity". The button links to a subdomain of ad-new.xyz (not sure if I am allowed to post this. Please remove the link if ...
1
vote
1answer
90 views

how to investigate diff between theguardian.com and tehguardian.com

One website is the....com the other is teh....com. They display the same content. The whois data is radically different. Ping reports different IPs. TheGuardian.com hasn't responded to my request ...
-1
votes
1answer
480 views

Unknown website using my domain name [closed]

I own andchat.net which I've left dormant and should not lead to any website. My nameservers were pointing to ns1.linode.com and ns2.linode.com (my previous hosts). Today I just realized if I visit ...
0
votes
1answer
134 views

Viewing local users on a workstation when I'm SYSTEM on Forest PDC

I'm doing some exercises on a challenge lab. I'm SYSTEM on the Forest PDC. I need to figure out the SID of a local user on a machine in another domain in the forest. I can get there with PTH and run ...