254

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F. $ echo fhepfcelehfcepfffacacacacacacabn | tr a-p 0-9a-f | xxd -r -p | xxd 00000000: 574f 524b 4752 4f55 5020 2020 2020 201d WORKGROUP . This appears to be a NetBIOS name, which ...


82

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names. This is how I would assess those conflicting measures: Use unpredictable host names Benefit(s) An ...


73

The hostname is included in the initial SSL handshake to support servers which have multiple host names (with different certificates) on the same IP address (SNI: Server Name Indication). This is similar to the Host-header in plain HTTP requests. The name is included in the first message from the client (ClientHello), that is before any identification and ...


54

Your public facing IP address is for most intents and purposes public information. No security should be dependent on it being private, however it's not something you want to wave around willy nilly necessarily (just like you wouldn't wave your home address around) but it also isn't something that is hard for someone to find with generally minimal effort if ...


45

Easier to hack? No. Easier to DoS? Potentially. Using an IP address instead of a host name with a DNS entry means you're giving up a layer of routing flexibility that can be very beneficial. For example, if malware targets your IP address in a DoS attack, if you're using a domain name, you switch the IP address of the site and in the DNS record, and ...


41

Your network guy might have a good reason for not wanting to share the information you enquired about. You see, what you describe you asked him of is not the IP range (CIDR) your company has been assigned to, but actual list of individual live IPs within that ASN. Now, getting the CIDR range that your organisation was assigned to its ASN is relatively easy, ...


39

Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain live.fi by having the address hostmaster@live.fi. Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long ...


35

Update: This answer by Miles is a better insight, the explanation given by NextDNS support seems wrong. I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet connectivity. Knowing where to look, I found numerous references for the same behavior: This article from 2012 discusses the mechanics with similar ...


33

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.


32

Some common risks to check: Domain has Bad reputation - check for any existing negative online reviews for the domain. Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc. Domain is Black listed - Domain on black lists such as Web of Trust and spam lists. ...


32

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. ...


27

The answer depends on the web-server you are using. For example, apache allows for the creation of multiple virtual hosts, of which the first described is considered the default one. What I suggest to do, is to create this default "catch-all" virtual-host with a global deny rule on it. Then configure your own web-site with a virtual-host identified with ...


25

I don't think they are actually redirecting to your site. If it was a true redirect, then the phone number couldn't be different. My guess is your website was scraped and copied to another site. They registered a new domain and used the content of your site. Then they created some spam SEO links to trick Google into moving them up higher in the rankings to ...


22

SNI is there for virtual hosting (several servers, with distinct names, on the same IP address). When a SSL client connects to a SSL server, it wants to know whether it is talking to the right server. To do that, it looks for the name of the intended server in the certificate. Every evil hacker can buy a certificate for his own server (called evilhacker.com),...


21

I think this guy is wig-freak, LOL, no for real I'm almost sure that this guy doesn't know what he is doing. I can see that actually he is just mirroring existing wig-websites and changing some of the links, but meanwhile he is forgetting to change other links which are redirecting to original website. These are some of his domains: ...


19

The fact that there is no readily available information to support your conclusion, should give you some idea about its validity. The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress)...


17

Typically if your site is accessible as http://1.2.3.4/ that would imply that it is not enforcing any limitations on the Host: header. That would mean that you could access it not just through IP address, but any hostname that happened to resolve to that address - including a domain an attacker registered and pointed at it. This opens up DNS rebinding ...


15

In addition to the ones mentioned already, the previous owner may have a SSL certificate that may still be valid. That would be a major issue especially for sites dealing with commerce.


15

What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in practice. It (1) adds complexity to the system which leads to errors, (2) dilutes the understanding of what information is secret and what isn't, and (3) may have a ...


14

No, the certificate would not appear as trusted in the user's browser, because the connection would fail, because the user's browser would not be able to complete an SSL/TLS handshake with the server. In order for the handshake to be completed, the server must have the private key that corresponds to the public key in the certificate.


13

As the previous two mentioned the malware wasn't connecting to the unregistered domain name. The unregistered domain was a technique that was supposed to be used to prevent analysis of the malware. Often times when malware researchers are picking apart malware they do so in a virtual machine. The way certain virtual machines resolve domain names result in ...


11

For the issuing part, everything can be put in a certificate. That a name is "wildcard" has no special significance for the CA. The CA puts a string as dNSName in a Subject Alt Name extension, and that's it. Whether this string contains "*" characters or not will not impact the CA behaviour. What matters is what SSL clients will accept as a "valid ...


10

If you google for wigsforwomenny you will see results with blog spam that links to it. Someone is probably gaming Google's links in order to make their fake site seem reputable. Instead of generating a fake wig site, though, they simply set their referrer to point to a legitimate site - yours. That way if someone does follow through their link spam, it ...


9

Get used to these. You will get them regularly. A lot of overpriced registrars make a living going around sending out e-mails and even snail mail like this to try to get website owners to pay for services from them. The services are generally legitimate but overpriced and often sent prior to actually being needed. They are correct that you must keep your ...


9

Typically, if you add SSL and enforce it then he's got two choices - act as a HTTP proxy that strips the encryption (potentially mirror the site instead; waste of resources on his side either way) or let the user see a big fat warning message about a certificate error. This should be sufficient for most circumstances to prevent domains not under your ...


8

1. Zone transfer Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack. Tools for zone transfers The second answer on that question mentions how to test for it for both Windows and Linux: Windows: nslookup > server <DNS you are querying> &...


8

This is really a matter of each CA's policies. Most of them require proof of ownership of a domain before issuing a certificate. Even with cheap CAs this usually involves either verifying an e-mail can be received by a WHOIS contact or making entries in the DNS records for the domain.


7

Knowing which IP exist at all in a network can be some valuable information for an attacker, if the organization owns a full range of IP addresses but actually uses only a few of them. The idea being that if there are 10000 addresses to choose from, but only 20 with actual machines behind them, the attacker may spend some time trying to reach inexistent ...


7

I agree with AJ that even cheap CAs involve verifying emails from data retrieved from a WHOIS request. But this sort of verification often has many holes in it and doesn't cryptographically ensure the validation. That is an attacker who can eavesdrop/alter unencrypted traffic on the internet can potentially: intercept the email sent over the internet from ...


Only top voted, non community-wiki answers of a minimum length are eligible