Domain Shadowing: Detect Compromised DNS at Scale

Most phishing guidance focuses on newly registered domains. Domain shadowing takes the opposite route: an attacker compromises a legitimate domain account and creates malicious subdomains underneath a trusted parent.

The parent’s age and reputation can help the attacker bypass controls. Defenders must therefore score the complete hostname and its recent behavior, not inherit trust from the registrable domain.

How Domain Shadowing Works

An attacker obtains access to a registrar, DNS provider, hosting panel or delegated account. They add many subdomains, often with automated names, and point them to redirectors, phishing pages, exploit delivery or command-and-control infrastructure.

This behavior aligns with the broader MITRE ATT&CK concept of compromised domain infrastructure. Common properties include:

• an old parent domain with very new subdomains;
• DNS answers outside the owner’s normal providers;
• rapid record changes or short TTLs;
• unauthorized certificate issuance;
• multi-stage redirects to a final malicious page;
• dozens of sibling hosts created in a short window.

One compromise can support multiple campaigns, so treating each subdomain as an isolated IOC wastes valuable context.

Detection From the Domain Owner’s View

Enable strong, phishing-resistant authentication on registrar and DNS accounts. Restrict API tokens, separate production zones, log every change and alert on new records, nameserver changes and credential creation.

Maintain an inventory that maps each hostname to an owner, environment and purpose. Diff the live zone against infrastructure-as-code or another known-good source. Monitor Certificate Transparency for unexpected names.

High-priority owner alerts include:

• many records created by one identity;
• changes from a new country, ASN or device;
• records pointing outside approved infrastructure;
• disabled DNSSEC, registry lock or audit settings;
• a new API key followed immediately by zone changes.

Detection From the Defender’s View

Security teams investigating external traffic may not own the parent domain. Evaluate the full FQDN:

1. identify first-seen time for the subdomain;
2. compare its IP and ASN with sibling hosts;
3. inspect historical DNS changes;
4. review certificate issuance and redirect chains;
5. search for other subdomains with similar labels or paths;
6. correlate email, proxy and endpoint sightings.

Use the subdomain finder, DNS history and URL scanner. Parent-domain reputation is context, never a reason to skip full-host analysis.

Build a Shadowing Score

Useful features include subdomain age, sibling creation velocity, lexical randomness, TTL, provider deviation, certificate timing, redirect depth and page similarity. Add internal prevalence: a hostname queried by one mailbox immediately after a phishing message has different risk from a widely used SaaS host.

Avoid overfitting to random labels. Marketing platforms and customer-isolation systems legitimately create many subdomains. Verified ownership and a stable infrastructure pattern reduce risk.

Incident Response for the Domain Owner

Treat the DNS account as compromised until disproved:

• revoke sessions, rotate passwords and API tokens;
• enforce phishing-resistant MFA;
• remove unauthorized records and certificates;
• review nameservers, DS records, contacts and recovery methods;
• preserve provider logs and identify the initial access path;
• monitor for re-creation and related domains.

Coordinate blocking and abuse reporting, but avoid taking the parent domain offline unless the blast radius is understood. A precise hostname block may protect users while the zone is repaired.

Metrics

Track unknown subdomains, time from record creation to alert, changes without an owner, malicious siblings discovered per incident and time to secure the DNS account. For external monitoring, measure how often full-host analysis changes a benign parent-domain verdict.

Conclusion

Domain shadowing exploits inherited trust. Defeat it with change auditing, certificate monitoring, full-host reputation and sibling analysis. Combine contextual threat intelligence with rigorous DNS account security so an old domain cannot silently become new attacker infrastructure.