Cybersecurity glossary
What is Domain Shadowing?
Learn what domain shadowing is, how attackers abuse compromised legitimate domains by creating hidden subdomains, and which DNS and account controls reduce the blast radius.
Definition
Domain shadowing is the abuse of a legitimate domain after attackers compromise its management account and quietly create malicious subdomains under the real domain without taking over the entire site.
Why domain shadowing is so deceptive
Many defenders are taught to distrust newly registered domains, obvious impersonation domains, and domains with weak reputation. Domain shadowing inverts that instinct by hiding malicious content inside the namespace of a domain that already belongs to a legitimate business, school, or nonprofit.
That inherited trust buys the attacker time. Users may see a familiar root domain. Security tools may have years of benign history for the parent domain. Meanwhile, the attacker only needs enough access to add DNS records for a few hostile subdomains.
Why attackers like the technique
Domain shadowing is attractive because it blends account compromise with infrastructure abuse. The criminal does not need to win a search-engine battle for a new domain; they borrow credibility from the existing one.
Inherited reputation
The parent domain already exists in email threads, search indexes, allowlists, and user memory.
Selective visibility
Attackers can create only the subdomains they need, leaving the main site and other records untouched.
Rapid rotation
New subdomains can be added and removed quickly once the DNS control plane is compromised.
Low operational cost
The adversary avoids registering and warming up fresh domains for every campaign.
How a shadowing campaign unfolds
Compromise the management account
Attackers steal registrar, DNS-provider, or delegated admin credentials through phishing, malware, or token theft.
Study the existing zone
They learn how the domain is structured so unauthorized changes blend in with normal records and naming patterns.
Create shadow subdomains
The adversary adds new labels such as login-help.example.com or docs-update.example.com without disturbing the primary site.
Point them at attacker infrastructure
The subdomains resolve to phishing kits, malware redirectors, or proxy servers controlled by the campaign.
Rotate and prune
As indicators become known, the attacker deletes some subdomains and creates others under the same trusted parent.
Exploit defender lag
The campaign continues until the owner notices the unauthorized DNS changes or the provider intervenes.
Domain shadowing compared with similar DNS abuse
| Pattern | What the attacker abuses | Common clue |
|---|---|---|
| Domain shadowing | A legitimate domain's management account | Unexpected new subdomains under a long-established root domain |
| Typosquatting | A newly registered lookalike domain | Misspellings or visually similar characters in the domain itself |
| Dangling DNS takeover | A stale record pointing at an abandoned service | Valid DNS name with an unclaimed backend resource |
| Fast-flux | Rapid answer rotation behind one malicious domain | Frequent IP or NS churn with short TTLs |
Detection and containment habits that help
The hardest part of domain shadowing is that the abuse may look like an ordinary subdomain rollout unless someone asks whether the change was expected. DNS visibility and account hygiene matter equally here.
- Require phishing-resistant MFA for registrar and DNS-provider accounts that can create or edit records.
- Log and review every DNS change, including who created the record, when it changed, and from which IP or session.
- Maintain an approved subdomain inventory so newly observed labels can be checked against real business owners.
- Alert on unusual bursts of subdomain creation, especially when naming patterns resemble login, billing, update, or document themes.
- Inspect TLS certificate issuance for unexplained new subdomains under sensitive brands.
- Remove delegated access that is no longer needed and rotate API tokens used by automation.
- Coordinate DNS response with phishing takedown, email security, and web-proxy teams because the malicious subdomain is often only one part of the campaign.
- After recovery, review whether the attacker also changed MX, NS, redirects, or web hosting settings beyond the obvious shadowed labels.
Where investigations lose time
Teams often spend too long validating the content hosted on the subdomain and not enough time tracing how the subdomain got there. For domain shadowing, the control-plane timeline matters: who authenticated, what changes were made, and whether access tokens or reseller portals were involved.
Another trap is removing only the currently abused hostname. If the attacker still holds access to the account, new shadow subdomains can appear minutes later.
The practical takeaway
Domain shadowing is not about registering a fake domain. It is about secretly planting hostile subdomains inside a real domain after compromising the owner's DNS management path.
The strongest defense pairs strict DNS account security with continuous subdomain inventory. If you cannot quickly tell whether a new subdomain is expected, a shadowing campaign has room to hide.
Related security terms
Subdomain
The delegated label attackers create beneath a real domain during a shadowing campaign.
Domain Hijacking
A broader control-plane compromise that can affect an entire domain rather than selected shadow subdomains.
Dangling DNS Record
A different DNS abuse path where stale records expose abandoned resources to takeover.
Fast-Flux DNS
An infrastructure-resilience technique that may appear alongside shadowed subdomains.
NS Record
The delegation record that determines which name servers can publish new shadowed subdomains.
Frequently asked questions
What is domain shadowing in simple terms?
It is when attackers sneak malicious subdomains under a real domain they do not own by logging into the legitimate owner's DNS or registrar account.
How is domain shadowing different from typosquatting?
Typosquatting registers a lookalike domain such as examp1e.com. Domain shadowing instead creates malicious subdomains directly under the real victim domain, such as update-secure.example.com.
Do attackers need to deface the main website?
No. The parent site can appear completely normal while only selected subdomains are created and pointed at malicious infrastructure.
Why do defenders sometimes miss shadowed subdomains?
Because the parent domain already has reputation and trust, and many organizations do not continuously inventory every newly created subdomain.
Can domain shadowing support phishing?
Yes. A phishing URL under a real, established domain can look more believable to users and sometimes to simplistic reputation filters.
Is domain shadowing caused by DNS protocol flaws?
Usually no. The common root cause is account compromise or weak operational controls around DNS management.
How do you stop a shadowing campaign?
Lock down the affected account, remove unauthorized DNS records, rotate credentials and tokens, review audit logs, and hunt for linked phishing or malware infrastructure.
References
Explore authoritative guidance and frameworks related to domain shadowing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.