#subdomains — Public Fediverse posts

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

It's been a while since I've found a need to do this, and I assume tools have changed a bit, so some #FediHelp would be appreciated...

What is the most accurate way to find existing #DomainNames , or more specifically, #SubDomains , where I already know the #TLD ?

#VirusTotal allows me to drill down from the main serving IP address to get to the #ASN - then reference the "Relations" tab for passive #DNS replication -BUT- I suspect the list may only be partially complete and/or 'outdated'.

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme wrote: "The change I referred to prevents arbitrary sibling/parent-domain abuse […]"

I'm not sure if you're referring to the possible match on
"evil-example.com" (see screenshot) in the old code, but if I remember correctly (from my analysis approx. 3 years ago), the client will only accept an exact match of "example.com" or
"<whatever_including_dots>.example.com".

So albeit ugly, the old server code should not pose a risk I guess?

W.r.t. unexpected abuse of valid subdomains (*): my worry is that people will use your code for their site without modification, never considering the risk I described.

(*) Or malicious JS (3rd party or XSS) on the main domain - while WebAuthn handling was supposed to take place only on e.g. "login.example.com" (using a dedicated subdomain may be a good idea like Dirk Balfanz wrote).

Since your site appears to be using passkeys as an additional factor, the users of your site may not be at risk. However, the idea of passkeys was to "go passwordless", something that other users of your code will probably embrace.

I haven't scanned all of your code, but if not present, my advice is to at least add a warning for unexpected WebAuthn processing on a subdomain (or even the main domain).

#Passkeys #RPID #SubDomains #WebAuthn

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

@ScottHelme from https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/:

"It now requires an exact match or a true subdomain."

That is probably insufficient. Please read https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580 by Dirk Balfanz (Google, screenshot of part of the entry below).

Google doesn't want potentially malicious (e.g. https://sites.google.com) or "forgotten" subdomains (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Subdomain_takeover) to be able to handle passkeys.

As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in https://todon.nl/@ErikvanStraten/116595157772945666.

Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

According to the RELATIONS tab in https://www.virustotal.com/gui/domain/report-uri.com your domain has (at least) 3.2K subdomains. Do you trust each of them?

#Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

Ah yes, the classic tale of a college freshman who thinks they've discovered the Holy Grail of tech hacks: #subdomains on a campus network. 🤦‍♂️ Of course, turning this "revelation" into a grand scheme to control every projector and camera on campus is just one #DNS record short of a Hollywood blockbuster. 🎬💻
https://www.edna.land/blogs/posts/scanning/ #techhacks #collegefreshman #cybersecurity #campuslife #HackerNews #ngated

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

I just saw the dumbest thing ever. A company has it.com. They are selling subdomains on it.com as if it's worth anything. WTAF? Come on people. With the amount of gTLDs exploding, wtf would I want a subdomain at it.com? Seriously? I don't get the play. Ugh, people will try anything, won't they.

#domains #subdomains #web #onlinelife

So many web apps I have installed. 😄

#SelfHosting #YunoHost #Docker #WebApps #ITStudent #DigitalAutonomy #TechStack #Subdomains #Linux #OpenSource #KalvinBase #Nulu #Memos #OpenGist #Invidious #Redlib #Zusam #TechLife #SystemAdmin #IT

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

How is it possible for someone to implement a redirect on a subdomain of my domain, e.g. subdomain.bl.ag? And what do I need to do to reclaim it?

#AskFedi #Domains #Subdomains #Redirects

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Top French Football Leagues Win Pirate IPTV Blocking Orders

https://torrentfreak.com/top-french-football-leagues-win-pirate-iptv-blocking-orders-240813/

#SiteBlocking #siteblocking #Anti-Piracy #subdomains #France #ligue1 #ligue2 #iptv #DNS

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈

Tool: https://github.com/lukeswitz/Subterfuge

#bugbountytips #hackerone

Hunting #subdomains on a subdomain… 40k #permuations excessive? Maybe.. but I’ll take the 6x increase 📈
#bugbountytips #hackerone

📬 Spaniens Behörde S2CPI kämpft mit Subdomains
#Internet #Netzpolitik #PiracyShield #Richtervorbehalt #S2CPI #Spanien #Subdomains #Websperren https://sc.tarnkappe.info/0cd793

📬 Spaniens Behörde S2CPI kämpft mit Subdomains
#Internet #Netzpolitik #PiracyShield #Richtervorbehalt #S2CPI #Spanien #Subdomains #Websperren https://sc.tarnkappe.info/0cd793

Spain’s Ongoing Pirate Site-Blocking War Targets Thousands of Subdomains

https://torrentfreak.com/spains-ongoing-pirate-site-blocking-war-targets-thousands-of-subdomains-240531/

#administrativeblocking #siteblocking #subdomains #Piracy #Spain

Spain’s Ongoing Pirate Site-Blocking War Targets Thousands of Subdomains

https://torrentfreak.com/spains-ongoing-pirate-site-blocking-war-targets-thousands-of-subdomains-240531/

#administrativeblocking #siteblocking #subdomains #Piracy #Spain

Cloudflare Email Routing subdomain support, new APIs and security protocols:

https://blog.cloudflare.com/email-routing-subdomains/

#Cloudflare #email #routing #subdomains

ping: subdomain.domain.tld: Name or service not known

Subdomain.center – discover all subdomains for a domain
https://www.subdomain.center/
#ycombinator #subdomain #subdomains #arpsyndicate #subdomain_lookup #subdomain_finder #subdomain_api

Without being a (good) developer I make a few decisions that I want to discuss. I am using three #subdomains for my website(s). I don't care for the resources (including the licenses) of running three #WordPress. I care if I murder my SEO score in a nonsense way. So I have a "blog" subdomain for my #blog posts, another for my main job and one for a side project. Should I spend a week of my life and make subdirectories or put all my work under one #website?

Without being a (good) developer I make a few decisions that I want to discuss. I am using three #subdomains for my website(s). I don't care for the resources (including the licenses) of running three #WordPress. I care if I murder my SEO score in a nonsense way. So I have a "blog" subdomain for my #blog posts, another for my main job and one for a side project. Should I spend a week of my life and make subdirectories or put all my work under one #website?

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

Fun stuff coming from the #Netlify team today! Custom #subdomains for deploy previews and branch deploys. https://front-end.social/@melanie/110095969789799954

Fun stuff coming from the #Netlify team today! Custom #subdomains for deploy previews and branch deploys. https://front-end.social/@melanie/110095969789799954

Are you allowed to be proud when your work is included in SecLists? 🥲

#SecLists #pentesting #RedTeam #BugBounty #wordlist #DNS #subdomains #hacking #recon

Are you allowed to be proud when your work is included in SecLists? 🥲

#SecLists #pentesting #RedTeam #BugBounty #wordlist #DNS #subdomains #hacking #recon

🚨 New lesson!

Learn how to seamlessly share AdonisJS sessions & authentication across subdomains with our latest lesson.

#adonisjs #webdev #authentication #sessions #subdomains

https://www.youtube.com/watch?v=FoMzOMgz278

🚨 New lesson!

Learn how to seamlessly share AdonisJS sessions & authentication across subdomains with our latest lesson.

#adonisjs #webdev #authentication #sessions #subdomains

https://www.youtube.com/watch?v=FoMzOMgz278

FAQ:
Are all these #CIDR blocks and #subdomains 100% malicious? - No, but they do host a SUBSTANTIAL amount of #C2 infrastructure
What’s the grid thingy? - A #HilbertCurve map of #IPv4 space
You spelled #sarlacc wrong! - The name is intentional🤓

DM @Abjuri5t for more info

FAQ:
Are all these #CIDR blocks and #subdomains 100% malicious? - No, but they do host a SUBSTANTIAL amount of #C2 infrastructure
What’s the grid thingy? - A #HilbertCurve map of #IPv4 space
You spelled #sarlacc wrong! - The name is intentional🤓

DM @Abjuri5t for more info

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

#Subdomains or #subfolders?

Which one should you use for your #website?

#SEO #google #subdomains #subfolders

https://www.urlinspector.com/blog/subfolders-vs-subdomain/?via=social

#Subdomains or #subfolders?

Which one should you use for your #website?

#SEO #google #subdomains #subfolders

https://www.urlinspector.com/blog/subfolders-vs-subdomain/?via=social

@dgold
We thought .io domains were input/output!

The legacyInternet itself is problematic. We are supporters of I2P forming the #newInterent. The only problem with I2P is #subdomains don't work in the way that people might expect them to.

@neil

True.

You could conceivably use #subdomains in #Tor.

One major limitation of #I2P is it doesn't do subdomains, properly in our opinion. Eg. subdomain.neilsworld.i2p

In I2P the 'subdomain.neilsworld' is sent together. So the following could be three completely different entities:

blog.neilsworld.i2p
xmpp.neilsworld.i2p
a59b2cd3e4f1.neilsworld.i2p

This is the one thing that bothers us the most about I2P, to be honest.

Everything else is supurb and better than Tor.