132
votes
Accepted
Can someone read my E-Mail if I lose ownership of my domain?
Now if someone buys the domain and creates a mx record pointing to the his own mail server he can read all my confidential emails the people are sending me right?
If they register the domain name, ...
- 67.3k
104
votes
Possible reason for displaying two different websites on single domain?
This is obviously a spamming or scamming site, either setup on purpose or a hacked legitimate site. If visited without Referer header it will show some seemingly innocent site:
$ curl http://www....
- 208k
55
votes
Can someone read my E-Mail if I lose ownership of my domain?
As others already mentioned: Yes keeping a domain name is the only way to be sure that nobody is going to receive emails sent to there.
That being said:
Just keeping a domain is often cheaper than ...
- 1,705
52
votes
Accepted
Domain about to expire. Afraid that new owners will spread malware
Unless your freeware is somewhat popular or used by high-value targets, its usefulness for conducting supply chain attacks is probably limited. If the domain name enjoys good SEO, I would rather ...
- 8,465
26
votes
Possible reason for displaying two different websites on single domain?
As Steffen Ullrich has said, the reason for displaying different website is different Referer header; the underlying server was compromised and configured to show different content based on header (e....
- 385
23
votes
Can someone read my E-Mail if I lose ownership of my domain?
Assume someone will definitely buy your domain, as domain crawlers try to lock and resell, overpriced, domain names that people forget to renew. An MX record is not required in order to have mails ...
- 5,418
20
votes
Domain about to expire. Afraid that new owners will spread malware
Cost makes a big difference. Some people think keeping a domain means spending hundreds of dollars a year because "that's what we've always paid", but that really is not the case.
If the ...
17
votes
Accepted
A security warning when accessing a site through IP
It's because you generally create a TLS Certificate for an hostname, not an IP. Changing IP addresses is trivial, changing domains are not that common.
If you open the site in Firefox using IP, you ...
- 55.5k
17
votes
Possible reason for displaying two different websites on single domain?
Possible infection with malicious code known as (SEO Spam). That's why it is serving with title:
<title>Cheap Cialis In Usa — Get Bonus Pills</title>
Maybe it was hacked due to ...
- 10.2k
14
votes
Can someone read my E-Mail if I lose ownership of my domain?
Loss of domain name is actually one of the biggest security vulnerabilities that I see "in the wild".
It may not rate a symposium topic at Blackhat, but the threat has a gigantic surface area and ...
9
votes
Can someone read my E-Mail if I lose ownership of my domain?
Yes, the scenario described is possible. As an example, it happened to Google in 2015 when they lost control of google.com, and Microsoft back in 2003 with hotmail.co.uk. Those domains got bought. ...
- 890
5
votes
A security warning when accessing a site through IP
The error indicates that you have reached a site that cannot prove it owns the address that you entered in the address bar.
Imagine this. You visit https://www.google.com. You check the certificate ...
- 9,361
5
votes
Accepted
Is there any point in activating domain privacy after the fact?
Sure there is. All forms of security are about making the attackers job more difficult, not impossible. A physical safe doesn't stop the bad guy from getting the stuff inside, it just makes the ...
- 1,962
5
votes
Should I buy nonsense domains just to make sure my clients don't visit a misspelled domain?
Only you can decide whether or not it's worth it. There are a few situations that you should consider:
How does your typical user visits your site? Are they primarily visiting because you gave them ...
- 31.6k
5
votes
Accepted
What is the list of known host domains where subdomains come from different providers?
It sounds like you want The Public Suffix List. It covers things like wix.com and dyndns.org where subdomains are under individual control, and national TLDs some of which have very insteresing ...
- 1,376
4
votes
Accepted
What is the effect on a domain when the secondary name server is compromised?
DNS resolvers choose the name server to obtain the answer from randomly. There is no difference between primary and secondary NS servers from this point of view.
If you have 2 NS servers and one is ...
- 305
4
votes
Accepted
Which Extensible Provisioning Protocol (EPP) status-values provide sufficient protection against domain hijacking?
Generally speaking, the EPP codes will not help prevent domain theft/hijacking, at least in generic top-level extensions.
Before 2006, it was possible to steal .com/.net (possibly other extensions) ...
- 8,465
4
votes
Subdomain takeover due to improper records
Snapchat had this Fastly instance set up, but eventually cancelled their service. However, they had forgotten to remove the DNS record, which allowed this researcher to simply to register a new Fastly ...
- 47
4
votes
Accepted
Receiving lots of spam after registering a new domain on GoDaddy
Anybody can see new domain registrations, at least in mainstream extensions like .com/.net/.org. This is public information and you could even compile this data for yourself using zone files.
You can ...
- 8,465
4
votes
Is there a more secure way for users to log into the domain other than just passwords?
The EAP-TLS authentication mechanism deployment as described only proves that an authorised user is operating the device. This could be a certificate in the local user's profile, the computer's ...
- 587
4
votes
Can someone read my E-Mail if I lose ownership of my domain?
Yes, the new owner will be able to receive and read all your email. The only way to avoid this is to continue paying for the domain. It is not necessary to keep hosting - only pay the domain. If you ...
- 143
4
votes
Is it possible for a domain to be faked?
Domains are "faked" all the time. All you need to do is to change the DNS entry. You can do this by setting up a malicious DNS server or to edit the computer's local hosts file that acts ...
- 132k
3
votes
Accepted
Is there a more secure way for users to log into the domain other than just passwords?
Block domain admin login from interactively logging into regular user workstations. You can do this with Group Policy.
Restrict admin connections to trusted admin hosts. The firewall on your ...
- 538
3
votes
Is it technically possible to configure two different SSL certificates for the same domain?
I am thinking it may be possible using SSL offloading, deep packet inspection, and TLS renegotiation. However, if you google TLS renegotiation, the top 20 hits will be about renegotiation ...
- 9,361
3
votes
Accepted
Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?
Yes, you can use different certificates and change certificates as much as you want, as long as you keep using HTTPS. HSTS, preload included, does not restrict what certificates you can use. It only ...
- 65.8k
3
votes
Accepted
Does a domain alias give any security against hackers?
It's absolutely trivial for an attacker (or security researcher, or hacker) to find out what the hostname is for requests going to the API for your app. There's multiple techniques that can be used ...
- 16.1k
3
votes
Ransomware - All computers infected but one
The concept you are looking for is "persistence". You don't want to destroy your route to continue to extort the victim.
If you encrypt the machine that is your route in, then the victim ...
- 132k
3
votes
Can someone read my E-Mail if I lose ownership of my domain?
Are there ways to prevent that or is the only option I have is to pay
for the domain until I die?
Depending on who is hosting your email, you maybe able to setup an auto-responder.
Usually some kind ...
- 538
3
votes
Accepted
One domain using certificate of other domain
2] Has B.com installed A.com certificate by mistake? 3] ´If so, how can they get private key for that purpose?
Probably A.com and B.com are both hosted at the same server and have the same IP address....
- 208k
3
votes
Accepted
Would my IP be recorded when I visit a website
The website admin certainly knows your IP Address. If they didn't they couldn't send you the website you requested. Whether or not they record your address or try to track you is entirely up to them.
...
- 31.7k
Only top scored, non community-wiki answers of a minimum length are eligible