A web domain name is the foundational piece of internet property allowing its owner (registrant) to construct and host an associated website. On a domain, the owner is also able to construct whatever subdomains they wish—a process that is technically achieved via the configuration of records on the authoritative domain name system (DNS) server. A subdomain name is the part of the URL before the domain name, and separated by a dot (e.g., “blog” in the URL https://blog.cscglobal.com/). Subdomains can be used in the construction of web addresses for a number of different purposes, such as the creation of individual microsites for sub-brands or campaigns, or the production of region- or subject-specific subsites. Some internet service providers (ISPs), known as private subdomain registries, also offer the sale of specific commoditized subdomains of their site, allowing users to create their own sites (e.g., “second-level” domains such as blogspot.com, which allows users to register URLs in the form of username.blogspot.com, for the creation of a personalized blog in this case).

Subdomain name abuse in general internet content

From a brand monitoring point of view, the appearance of a brand name or other relevant keyword(s) in the subdomain name of a third-party URL can be associated with a variety of brand infringement types. Some areas of potential concern include:

• As a means of driving traffic to third-party content via misdirected search-engine queries
• Creating sites featuring claims of affiliation with the brand in question
• Reputation issues—e.g., creating sites containing information, customer comments, or activism-related material pertaining to a particular brand
• As a means of creating a URL appearing deceptively similar to that of an official brand site (e.g., for fraudulent activity, phishing, or the distribution of malware)

Brand-specific subdomains can be a source of confusion for internet users—and thus an effective threat vector—because of their similarity to familiar, legitimate URLs. For example, the hypothetical and unofficial domain cscglobal.blog.com could be used to create a convincing fake version of the official blog.cscglobal.com.

In recent months, a number of (often SMS-based) phishing attacks have been observed to make use of a brand name in the subdomain name to create a highly convincing, deceptive URL in a particular way^{1, 2}, as shown in the example in Figure 1.

In this example targeting U.K. customers of the bank, the phishing URL makes use of a reference to HSBC in the subdomain name, together with a domain name beginning with “uk-” (uk-account.help), as a means of producing a URL that appears visually very similar to the real “hsbc.co.uk/account-help.” The phishing site link also uses the HTTPS protocol, historically an indicator of trust, but now a characteristic shared by over 80% of phishing sites³ in response to the easy availability of secure sockets layer (SSL) certificates from free providers. This approach is particularly effective for a number of reasons, including the fact that it uses a new generic top-level domain (gTLD)extension that may be unfamiliar to some users, and the tendency for the displays in mobile devices to insert line breaks after hyphens. Zone file analysis shows there are at least several hundred registered new gTLD domains with names of a similar format that have the potential to be used fraudulently. Identified examples include uk-authorization-online.support, uk-gov.tax, uk-insurance.claims, uk-border.agency, and uk-lottery.win.

Other recent identified examples of branded subdomains in phishing scams include hermes.online-parcel-reschedule.com (for logistics company Hermes); and o2.billing9k7j.com (for telecommunications organization O2). This type of attack circumvents the requirement for the fraudster to register a brand-specific domain name (which is potentially easier to detect by a brand owner employing a basic domain monitoring service). In many cases, the WHOIS records for the parent domains are anonymized, making it difficult to establish links between cases. These domains are also often registered immediately prior to the attack and are used for a short period in an effort to circumvent detection and takedown efforts.

In general, brand-related subdomains on third-party sites are more difficult to detect than domain names themselves, which can much more easily be identified through wildcard searches of registry zone files. The most straightforward method for identifying subdomains is through search engine metasearching, providing the subdomains in question are linked from other sites and have been indexed by the search engines. Beyond this, the issue can partially be addressed through the use of other techniques, such as a detailed analysis of domain name zone configuration information (e.g., passive DNS analysis), certificate transparency (CT) analysis, or via the use of explicit queries on particular domains for the existence of specific subdomain names.

Other issues include private subdomain registries being problematic because they’re not necessarily regulated by the Internet Corporation of Assigned Names and Numbers (ICANN), and thus may lack dispute resolution procedures, abuse reporting processes, or records of any sort of WHOIS information.

When considering enforcement against infringing subdomains, options can be relatively limited—particularly in comparison with the range of approaches available for domain names. It’s sometimes possible to achieve engagement with the registry, registrar, hosting provider or DNS provider, but they may not be obligated to comply. Furthermore, many established dispute processes, such as the Uniform Domain-Name Dispute-Resolution Policy (UDRP), don’t necessarily apply to subdomains. However, exceptions do exist in some cases, such as certain new gTLDs, instances where the host domain name corresponds to a country code (e.g., jp.com), or other limited circumstances (e.g., those covered by the Dispute Resolution Service (DRS) for .NZ). Failing this, court litigation is often a last resort⁴.

Finally, the use of fraudulent domains in conjunction with wildcard MX records (which allow the domain owner to receive emails sent to any subdomain on the domain name) can also be a highly efficient way for criminals to intercept mail intended for trusted organizations, and thereby harvest sensitive information. This can be successful in cases where the recipient email address has been mistyped (i.e., with an extra “.” inserted). If the domain name is carefully selected, it can enable attacks against a range of different organizations (e.g., *.bank.[TLD] can be used to harvest mis-addressed emails intended for any organization with an official domain name of the form [brand]bank.[TLD]).

Subdomains of official domains within the brand owner’s own portfolio

Considering the domain security landscape, an area of primary concern for a brand owner is the existence of subdomains on domains under their own ownership.

Subdomain hijacking

Brand owners may use subdomains of official sites for a number of different purposes, as discussed previously. However, when they register a lot of subdomains—IBM^® has around 60,000 and Microsoft^® over 120,000—subdomain management can become a significant endeavor. The associated risks make it possible for bad actors to take over the subdomains through exploitation of expired hosting services (an issue known as “dangling DNS records”), DNS misconfigurations, or untrustworthy legitimate users. Compromise can also be achieved using pharming (DNS poisoning) attacks, where subdomain records are modified to re-direct traffic to a fraudulent IP address. This can give fraudsters the ability to create fake sites, upload content, monitor traffic, or hack official corporate systems⁵. A 2021 study identified over 1,500 vulnerable subdomains across 50,000 of the world’s most important websites⁶.

A number of news stories have emerged in recent years of corporations being attacked in this way, including instances of official corporate subdomains being hijacked to re-direct to content including malware, pornography, and gambling-related material. Subdomains of the Xerox website, for example, were used in 2020 to drive traffic to sites selling fake goods, taking advantage of the trusted reputation of the official corporate domain to boost the search-engine ranking of the malicious content⁷. In another case in 2019, GoDaddy^® shut down 15,000 abused subdomains that drove a massive spam campaign geared towards the sale of counterfeits⁸.

Brand owners can mediate these threats by analyzing their own domain portfolio and being mindful of any subdomains pointing to external IP addresses.

Domain shadowing

Another risk is the possibility for criminals to create new, unofficial subdomains of official sites via DNS compromise through a method such as phishing or dictionary attacks—a practice known as “domain shadowing.” This approach can also be used to drive users to threatening content, while taking advantage of the protections associated with being hosted on a trusted website (e.g., to circumvent site block listing). In one reported example of this practice, a number of domains (primarily registered through GoDaddy) were compromised to create over 40,000 subdomains pointing to Russian IP addresses hosting a range of malware variants^{9, 10}.

This type of attack can be difficult to detect, both because it avoids the requirement to make changes on the official corporate webserver, and because the infringing content is typically hosted externally. The damage may only become apparent following complaints by users, or in response to the official domain being added to a block list due to the malicious activity. Rigorous security measures are the primary preventative approach, including the use of strong passwords and two-factor authentication¹¹.

A related attack vector is the use of wildcard DNS records, which can result in any arbitrary subdomain name being set to re-direct to a malicious external IP address. Bad actors can use randomized, changing subdomains to circumvent hostname-based block listing (e.g., in coordinated phishing campaigns). This type of attack can be applied both to official (compromised) or third-party (stand alone) domains¹².

Overall, to mitigate these threats, brand owners should employ a robust domain security posture combined with a comprehensive program of brand monitoring and enforcement.