Questions tagged [domain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
59 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
0
votes
0answers
72 views

Risks associated with developers using their own domain for development services

We have some development and test environments using our canonical domain, e.g. dev.example.com. We also use some services from 3rd party providers that have obscure URLs like xjkhasdkjvhas.dns.ashdfb....
0
votes
0answers
28 views

Is one top level domain more inherently secure than another? [duplicate]

There's an interesting discussion going on at work right now. Someone wants to move their app off a .com domain and put it on a .net domain. They contend a .net domain can provide the level of ...
2
votes
0answers
88 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
1
vote
1answer
102 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
1answer
152 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
0
votes
1answer
65 views

Universal DNS Resolver [closed]

I would like to implement a DNS client which should be able to resolve any valid domain public, private or otherwise (tor,i2p). What's the best way to achieve this? I know that I need to pick a ...
3
votes
4answers
368 views

Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth ...
0
votes
1answer
52 views

One domain using certificate of other domain [closed]

I recently Googled a website e.g A.com and found B.com in search result at the top. In reality A.com should be on top as B.com doesn't have anything in common or related to A.com but Google shows it ...
0
votes
1answer
80 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
0
votes
2answers
110 views

how one can find out sub-domains of a domain without brute-force?

I had to edit my original question after several answers were submitted. Original question was: how one can find out sub-domains of a domain without brute-force? is there a way to request a domain ...
0
votes
2answers
63 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
100
votes
8answers
22k views

Can someone read my E-Mail if I lose ownership of my domain?

Let's assume I have a server set up with an email address like me@mydomain.tld. Now I have distributed my business card with the e-mail address to all people all over the world and they keep sending ...
2
votes
1answer
226 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
1
vote
0answers
52 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
1answer
73 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
-1
votes
1answer
35 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
0
votes
1answer
128 views

Benign, Malicious Domains and Definitions

I am working on a research project where we segregate domains used for malicious purpose from benign domains. However, my guide does not want the term malicious domain and benign domain in the paper....
0
votes
3answers
138 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
1
vote
0answers
211 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
2
votes
2answers
79 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
0
votes
1answer
201 views

Domain SSL encryption from client to DNS Server

Im wondering why the domain name is not encrypted when a request do a DNS Server is made. As it seems this is the main weaknesses for internet users. I came to this when i heard that in germany ...
2
votes
2answers
77 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
80
votes
3answers
9k views

Possible reason for displaying two different websites on single domain?

This is something interesting. Try going to http://www.circaventures.com/ You will get a venture capital company. Now go to google and search "Circa Ventures". The first result you get is the exact ...
0
votes
1answer
87 views

Where or how can I get list of domain dependencies of top 100 popular sites? [closed]

For example google.com depends on ssl.gstatic.com, lh3.googleusercontent.com, fonts.gstatic.com. I need this list for Proxy settings
5
votes
2answers
797 views

Manage SSL certificates for a multi-tenant website

We have given customers the option to allow custom domains which ultimately point to our server by changing the CNAME. Some of our customers would like to have SSL enabled to their domain but I am ...
0
votes
1answer
1k views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
1
vote
1answer
174 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
1
vote
2answers
196 views

How do you prevent a computer in a network from accessing RDP?

So you're on a domain. I know that Remote Desktop needs an authorized user's credentials (e.g admin) to log in with a remote computer. But can you also place a condition that you need to be using a ...
5
votes
2answers
188 views

Is there a more secure way for users to log into the domain other than just passwords?

Say you have this: An NPS server that grants access to users using client certificates (EAP-TLS). So for example someone managed to snatch the domain administrator's password and they log in to the ...
1
vote
1answer
214 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
6
votes
2answers
642 views

How can Cloudflare determine the owner of a website?

Assume that we have two websites with two different owners. Both of them set their domain name server to john.ns.cloudflare.com and joly.ns.cloudflare.com. The first owner set both domains in his ...
1
vote
0answers
75 views

DGA scheme on local network [closed]

Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated): 04/07/2017 13:36:47 12C8 ...
5
votes
3answers
1k views

Receiving lots of spam after registering a new domain on GoDaddy

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
4
votes
1answer
889 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
1
vote
1answer
756 views

Spam mail “is missing domain” [duplicate]

I just recieved a spam mail. They asked me to "confirm my amazon account / identity". The button links to a subdomain of ad-new.xyz (not sure if I am allowed to post this. Please remove the link if ...
1
vote
1answer
86 views

how to investigate diff between theguardian.com and tehguardian.com

One website is the....com the other is teh....com. They display the same content. The whois data is radically different. Ping reports different IPs. TheGuardian.com hasn't responded to my request ...
-1
votes
1answer
454 views

Unknown website using my domain name [closed]

I own andchat.net which I've left dormant and should not lead to any website. My nameservers were pointing to ns1.linode.com and ns2.linode.com (my previous hosts). Today I just realized if I visit ...
0
votes
1answer
119 views

Viewing local users on a workstation when I'm SYSTEM on Forest PDC

I'm doing some exercises on a challenge lab. I'm SYSTEM on the Forest PDC. I need to figure out the SID of a local user on a machine in another domain in the forest. I can get there with PTH and run ...
3
votes
1answer
459 views

Enumerate forest trust relationships

I'm trying to up my Windows domain enumeration game. I'm doing some exercises where I'm tasked to find the forest trust relationships without exploitation or creds or being on the domain. All ...
1
vote
1answer
246 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
0
votes
2answers
153 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
0
votes
1answer
81 views

How to separate and secure domains using cPanel?

When you add a new domain in some hostings (i.e. 000webhost or some other hostings, which DOESNT USE cPanel) an entirely separate public_html is created (with a separate FTP login and etc..). But ...
3
votes
0answers
852 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
0
votes
1answer
374 views

What are known domain hijacking methods?

The definition of domain hijacking is: "to gain (temporarily) control a domain" which could be either through: Stealing the legal and/or technical ownership of a domain (for example by transferring ...
1
vote
2answers
124 views

Spoofing domain registration date info

Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?
1
vote
1answer
76 views

Is there any point in activating domain privacy after the fact?

If I have a domain name that does not have privacy protection enabled, is there any point in enabling it now? Or is it useless once the information is out there? I'm asking this because I'm aware that ...
0
votes
1answer
75 views

Implications of joining the active directory domain with the domain administrator

I always used the domain administrator to join the active directory domain, but I've never set up more than a few machines. Is that considered a security risk, is the end-user somehow able to obtain ...
0
votes
1answer
96 views

How to make an image shown only on a particular domain [closed]

Is there is a secure way that makes an image allowed to display within a particular domain, and preventing it to be shown on any other website?
0
votes
1answer
56 views

Information security point of view when registering a domain and chosing a TLD

How much does the choice of the domain registrar and the TLD impact the security of my information? I've learned that some registrars will require more personal information than others. I even had a ...