#subdomains — Public Fediverse posts

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

So many web apps I have installed. 😄

#SelfHosting #YunoHost #Docker #WebApps #ITStudent #DigitalAutonomy #TechStack #Subdomains #Linux #OpenSource #KalvinBase #Nulu #Memos #OpenGist #Invidious #Redlib #Zusam #TechLife #SystemAdmin #IT

So many web apps I have installed. 😄

#SelfHosting #YunoHost #Docker #WebApps #ITStudent #DigitalAutonomy #TechStack #Subdomains #Linux #OpenSource #KalvinBase #Nulu #Memos #OpenGist #Invidious #Redlib #Zusam #TechLife #SystemAdmin #IT

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈

Tool: https://github.com/lukeswitz/Subterfuge

#bugbountytips #hackerone

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈

Tool: https://github.com/lukeswitz/Subterfuge

#bugbountytips #hackerone

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈

Tool: https://github.com/lukeswitz/Subterfuge

#bugbountytips #hackerone

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈

Tool: https://github.com/lukeswitz/Subterfuge

#bugbountytips #hackerone

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈
#bugbountytips #hackerone

📬 Spaniens Behörde S2CPI kämpft mit Subdomains
#Internet #Netzpolitik #PiracyShield #Richtervorbehalt #S2CPI #Spanien #Subdomains #Websperren https://sc.tarnkappe.info/0cd793

📬 Spaniens Behörde S2CPI kämpft mit Subdomains
#Internet #Netzpolitik #PiracyShield #Richtervorbehalt #S2CPI #Spanien #Subdomains #Websperren https://sc.tarnkappe.info/0cd793

📬 Spaniens Behörde S2CPI kämpft mit Subdomains
#Internet #Netzpolitik #PiracyShield #Richtervorbehalt #S2CPI #Spanien #Subdomains #Websperren https://sc.tarnkappe.info/0cd793