Domain Shadowing.

An attack in which a criminal compromises a legitimate domain owner's registrar account and silently creates malicious subdomains beneath the trusted parent domain. It belongs to the Attacks & Threats category of cybersecurity.

An attack in which a criminal compromises a legitimate domain owner's registrar account and silently creates malicious subdomains beneath the trusted parent domain.

Domain shadowing exploits stolen registrar or DNS-hosting credentials. Rather than registering a fresh suspicious domain, the attacker logs into the victim owner's panel and quietly creates hundreds of subdomains such as login.acme.example.com or invoice42.acme.example.com that resolve to attacker infrastructure. Because the parent domain is old, well reputed, and not visibly modified, the subdomains inherit reputation and frequently slip past URL-reputation filters, mail gateways, and TLS warnings. Domain shadowing has been used by exploit-kit operators (Angler, RIG) and phishing crews. Defences include strong MFA on registrar accounts, registry locking, DNS change-monitoring, and outbound web filtering that decomposes hostnames and inspects newly observed subdomains.

Defences for Domain Shadowing typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Subdomain shadowing.