Questions tagged [domain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
100
votes
8answers
23k views

Can someone read my E-Mail if I lose ownership of my domain?

Let's assume I have a server set up with an email address like me@mydomain.tld. Now I have distributed my business card with the e-mail address to all people all over the world and they keep sending ...
80
votes
3answers
9k views

Possible reason for displaying two different websites on single domain?

This is something interesting. Try going to http://www.circaventures.com/ You will get a venture capital company. Now go to google and search "Circa Ventures". The first result you get is the exact ...
27
votes
3answers
50k views

Is it technically possible to configure two different SSL certificates for the same domain?

Say I have these URLs: https://example.org/ https://example.org/criticalpath I want the first one to be served with a domain validated commercial SSL certificate and the second one with an extended ...
9
votes
1answer
319 views

Will enforcing this restriction on Domain Admins “break the network”?

Let's say we secure all servers in the domain.. Domain controllers allow RDP access only from jump servers Domain admins can't connect to non-dc servers And so forth This is all swell and should be ...
8
votes
4answers
10k views

A security warning when accessing a site through IP

When I go to https://www.schneier.com/, everything works normal. As soon as I access the same site using its IP address (66.33.204.254), I get a security warning (even if I write something like https:...
7
votes
1answer
6k views

Impersonating a computer in a Windows domain

I've been trying to wrap my head around how computers are identified and granted access to a Windows domain. More specifically, I've been asking myself if whatever mechanism is involved really ...
7
votes
2answers
1k views

Manage SSL certificates for a multi-tenant website

We have given customers the option to allow custom domains which ultimately point to our server by changing the CNAME. Some of our customers would like to have SSL enabled to their domain but I am ...
7
votes
1answer
2k views

Domain redirecting to my site without permission

I noticed that a domain that I don't own or know has been redirected to my site without my permission and has been affecting my SEO. I was able to block some of it by adding the following to the ....
6
votes
2answers
2k views

Can I use my old SSL certificate with websites in subfolders?

We have a single domain SSL for a website that looks like this: www.website.company.com We are going to expand and do following: www.website.company.com www.website.company.com/dk www.website....
6
votes
2answers
697 views

How can Cloudflare determine the owner of a website?

Assume that we have two websites with two different owners. Both of them set their domain name server to john.ns.cloudflare.com and joly.ns.cloudflare.com. The first owner set both domains in his ...
6
votes
1answer
4k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
5
votes
2answers
191 views

Is there a more secure way for users to log into the domain other than just passwords?

Say you have this: An NPS server that grants access to users using client certificates (EAP-TLS). So for example someone managed to snatch the domain administrator's password and they log in to the ...
5
votes
3answers
1k views

Receiving lots of spam after registering a new domain on GoDaddy

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
4
votes
2answers
2k views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
4
votes
1answer
983 views

Subdomain takeover due to improper records

INTRO On hackerone I see a few people writing reports on subdomain takeover due to improper records (CNAME I believe). I want to learn this 'skill' too. QUESTION I found a snapchat (sc-cdn.net) ...
4
votes
2answers
756 views

How much can I trust domain registrars to honor Whois identity protection services?

Domain name registrars offer whois ID protection services. I do plan to use such a service. But as I'm a relative newbie to the domain name registration world, I don't know whether I can trust it. ...
3
votes
2answers
3k views

document.cookie and its scope

There is some basic confusion that I have. A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the ...
3
votes
4answers
381 views

Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth ...
3
votes
3answers
7k views

How to make sure an API request is coming from a specific domain?

I'm opening up some API access to my site and my users are required to specify from which of their websites, such as example.com, they will make the API requests. I'm wondering if there's any way to ...
3
votes
2answers
91 views

Transferred domain to new registrar, ordered “id protection”, but my info is available in whois

Situation as per the title. How should I approach this to resolve it, am I wrong in thinking the ID protection should make my info not be visible? It's a .net domain. Edit - the visible details are ...
3
votes
2answers
121 views

Rerouting domains and the need for multiple SSL certificates

If a domain URL is registered with a .com (www.example.com) and we would like to re-route to this domain from a second domain name with a .com.tr (www.example.com.tr), is this possible? The .com ...
3
votes
2answers
212 views

Problems with using a non-reserved top-level domain for local DNS resolution

A network administrator at my organization (let's call him "Bill") wants to configure an internal DNS with the live top-level domain (TLD) .int for internal IP address resolution (for Active ...
3
votes
3answers
5k views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
3
votes
1answer
498 views

Enumerate forest trust relationships

I'm trying to up my Windows domain enumeration game. I'm doing some exercises where I'm tasked to find the forest trust relationships without exploitation or creds or being on the domain. All ...
3
votes
1answer
249 views

Where should we maintain external (subcontractors) usernames and passwords?

We have three environments: Testing and development Preproduction Production In our company all technical people, including sysadmins and network administrators, are subcontractors so a lot of them (...
3
votes
1answer
1k views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
3
votes
0answers
912 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
2
votes
1answer
2k views

Mail : non existent domain FROM field

I'm wondering if during the process of sending a message, the domain indicated in "from" field is checked? I know there is no integrity control of the from field, but I tried to send a message to an ...
2
votes
2answers
301 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
2
votes
2answers
109 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
2
votes
1answer
202 views

Which Extensible Provisioning Protocol (EPP) status-values provide sufficient protection against domain hijacking?

The Extensible Provisioning Protocol (EPP) as described in RFC 5730, can possibly be protective against domain hijacked. The protocol consists of the 17 following status-values as described in RFC ...
2
votes
2answers
88 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
2
votes
2answers
2k views

privacy - Which parts of URL is protected by HTTPS? [duplicate]

Assuming the website I visit uses HTTPS, which parts of the URL is protected from the eyes of my ISP? eg; https://subdomain.domain.com/path/file.php?param=value I know that domain.com (and probably ...
2
votes
0answers
129 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
2
votes
0answers
634 views

How can I check if a domain is malicious? [closed]

I have started to look for domain names inside my traffic. So I am interested to identify which one is malicious or doing some malicious acitivites. I know by looking at online web-services such as ...
1
vote
1answer
363 views

What can I do about a malicious site with a similar domain name?

I recently purchased a domain name (lets pretend it was generic.co), I checked to see what site was hosted on the domain close to mine (generic.com). The site loads a fake blue screen of death and ...
1
vote
1answer
140 views

Is it possible for a domain to be faked?

I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
1
vote
1answer
77 views

Is there any point in activating domain privacy after the fact?

If I have a domain name that does not have privacy protection enabled, is there any point in enabling it now? Or is it useless once the information is out there? I'm asking this because I'm aware that ...
1
vote
1answer
114 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
1answer
171 views

Another domain pointed to my server, what are the risks?

I recently had another domain point to one of my servers. After adding some nginx configuration I was able to mitigate this. My server now throws a 404 in this scenario. My question is what are the ...
1
vote
1answer
253 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
1
vote
1answer
109 views

Protecting a website from being kidnapped

I have a MediaWiki website in Hebrew; As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible. I chose to give that website a Global TLD (a non ...
1
vote
1answer
92 views

how to investigate diff between theguardian.com and tehguardian.com

One website is the....com the other is teh....com. They display the same content. The whois data is radically different. Ping reports different IPs. TheGuardian.com hasn't responded to my request ...
1
vote
1answer
119 views

Domain sale - Is it DNS hijacking?

I am using a desktop that has two Linux distros and Windows 7 installed, and a laptop with same installation. Both of them are in my home network. And sometimes when I try to visit some websites such ...
1
vote
1answer
519 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
98 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
1
vote
1answer
112 views

No MX Records on a Possible Phishing domain?

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
1
vote
1answer
86 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
1
vote
1answer
185 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
1
vote
2answers
197 views

How do you prevent a computer in a network from accessing RDP?

So you're on a domain. I know that Remote Desktop needs an authorized user's credentials (e.g admin) to log in with a remote computer. But can you also place a condition that you need to be using a ...