Domain Name

Short Definition

A domain is the readable name of a website, like google.com or github.com. Instead of typing 172.217.164.78, you type google.com. DNS translates domain names to IP addresses computers actually use.

Full Definition

A domain name is a human-readable identifier for a location on the internet. It's part of a hierarchical system that makes the web usable.

Structure:

1subdomain.example.com
2│         │      │
3│         │      └─ TLD (Top-Level Domain)
4│         └─ Second-level domain
5└─ Subdomain (optional)
6
7Full examples:
8www.example.com
9api.example.com
10blog.subdomain.example.com

Levels:

• TLD: .com, .org, .io, .gov
• Second-level: example (in example.com)
• Subdomain: www, api, mail

How it works:

1. User types domain in browser
2. DNS lookup translates to IP
3. Browser connects to that IP
4. Server responds

Why It Matters

• Domains are how users find websites
• Trust associated with domain names
• Certificates tied to domains (HTTPS)
• Domains used in security policies (CORS, CSP)
• Domain ownership = control

How Attackers Use It

Attack techniques:

1. Typosquatting:

1google.com   ← Legitimate
2gooogle.com  ← Fake (extra 'o')
3g00gle.com   ← Fake (zeros instead of 'o')

2. Subdomain Takeover:

1# Company creates subdomain
2old-app.company.com → points to AWS S3
3
4# Company deletes S3 bucket but forgets DNS
5# Attacker creates bucket with same name
6old-app.company.com → now controlled by attacker

3. DNS Rebinding (SSRF):

11. attacker.com → 1.2.3.4 (attacker's server)
22. Validation sees: 1.2.3.4 ✓
33. attacker.com → 169.254.169.254 (DNS changed)
44. Actual request goes to: 169.254.169.254

4. Homograph Attacks:

1аpple.com  ← Uses Cyrillic 'а', not Latin 'a'
2apple.com  ← Real domain

Look identical but different domains.

5. Cookie Stealing via Subdomain:

1# Cookie set on .example.com
2# Attacker compromises: evil.example.com
3# Can steal cookies for all subdomains

How to Detect or Prevent It

Prevention:

For organizations:

• Register common typos
• Monitor for similar domains
• Use HTTPS with HSTS
• Implement CAA DNS records
• Monitor certificate transparency logs
• Remove dangling DNS records
• Use domain monitoring services

For applications:

• Validate domain against whitelist
• Check resolved IP address
• Use pinned domains for critical requests
• Implement CORS properly
• Set specific cookie domains

Example validation:

1from urllib.parse import urlparse
2
3ALLOWED_DOMAINS = ['example.com', 'api.example.com']
4
5def is_safe_domain(url):
6    parsed = urlparse(url)
7    domain = parsed.hostname
8    
9    # Exact match
10    if domain in ALLOWED_DOMAINS:
11        return True
12    
13    # Check if subdomain of allowed
14    for allowed in ALLOWED_DOMAINS:
15        if domain.endswith('.' + allowed):
16            return True
17    
18    return False

Detection:

• Monitor DNS requests for unusual domains
• Check certificate transparency logs
• Use domain reputation services
• Alert on newly registered similar domains
• Track subdomain enumeration attempts

Common Misconceptions

• "Subdomain = separate ownership" - Same owner controls all
• "HTTPS = legitimate domain" - Attackers get certificates too
• ".com more secure than .io" - TLD doesn't determine security
• "Domain in URL is clear" - Homograph attacks exist
• "Can't fake domain" - Typosquatting and homographs work

Real-World Example

Steam Login Typosquatting

Fake domains:

1steamcommunity.com   ← Real
2steamcommunitу.com   ← Fake (Cyrillic у)
3steamcommunity.co    ← Fake (.co instead of .com)
4steam-community.com  ← Fake (hyphen)

Result: Thousands of stolen credentials

GitHub Subdomain Takeover (Multiple)

1. Company creates: docs.company.com → GitHub Pages
2. Company deletes GitHub repo
3. DNS record remains: docs.company.com → old GitHub URL
4. Attacker creates repo with same name
5. Attacker now controls docs.company.com

Real cases: Uber, Shopify, Tesla, others

PayPal Homograph Attack

1paypal.com   ← Real (Latin characters)
2pаypаl.com   ← Fake (Cyrillic 'а')

Browser may show fake as real in address bar.

Related Terms

DNS, URL, Subdomain, IP Address, Certificate