Hijacked domain

[DKTastic]

I noticed my domain had been hijacked.

My nameservers were updated to cloudflare a few days ago. I’m still working with my registrar to see how this was possible.

I noticed the name servers had been changed to cloudflare.

I had not been using cloudflare for this specific domain.

I attempted to register the domain in cloudflare and to my surprise I was able to add it to my domain.

I then noticed the configured A records pointing to a webhost in the Netherlands.

A few questions, how does one claim ownership for a domain in Cloudflare?

How was I able to assign the domain to my account if somebody else must have configured before me?

Could my account be compromised and somebody added the domain to my or an account, configured it and removed it but the configuration remained?

[DKTastic]

Just a note that the name servers changed (the female/male) from when it was hi-jacked to when I took over the domain in cloudflare.

[sdayman]

Hijacking a domain would be a two-step process:

1. A Cloudflare customer adds your domain to their account (this is the easy part).
2. That same person hacks into your domain registrar and sets your domain to use the two Cloudflare name servers assigned to them. (This is the hard part, and your issue is with your domain registrar).

#1 is the easy part because it doesn’t take effect until the name servers have been switched over. There are many legitimate reasons to let someone add any domain to their account, but remember that it’s a useless effort unless they have domain access at the registrar.

[DKTastic]

But wouldn’t step 1 prevent me from adding the domain as well?

My registrar replied with “you have not been hacked, nothing to worry about, it was just a bug in our system”

[cloonan]

@DKTastic

prevent me

No, a bad actor taking step 1 does not prevent the legitimate domain owner from also taking step 1. The key, as @sdayman mentioned is that taking step 1 is useless unless you also have the ability to take step 2 and change nameservers.

And, big thank you for closing the loop with the detail from your registrar.

[DKTastic]

But if multiple users define the same domain with different ips… Which configuration is used?

I guess cloudflare is using multiple name servers but if several users end up on the same cloudflare name server… Who’s configuration wins?

[domjh]

Hi @DKTastic,

@DKTastic

if multiple users define the same domain with different ips… Which configuration is used?

whichever account has the nameservers set at the domain’s registrar.

@DKTastic

I guess cloudflare is using multiple name servers

A lot of different combinations!

@DKTastic

if several users end up on the same cloudflare name server

Being on the same nameserver pair is very uncommon, but not impossible. However, the same domain won’t be assigned the same two nameservers on two different accounts.

@matteo

This pair by default is the one of the account owner, but if the pair is the same as the account where the domain had been already added this pair is switched. There is also a limit on the number of registrations (way lower, orders of magnitude lower, than the number of combinations) in total a domain may be added after which support need to intervene to allow an addition to take place.

More info at:

Security in place to prevent Domain Hijacking

This post covers the basic security questions that users may have on adding a domain. Cloudflare has many security mechanisms in place in order to prevent domain hijacking. We spent an afternoon generating a list of one hundred common 2- to 4-letter names, like Bob and Lola. We then used them to create the domain names we handed out at signup. Initially there were 50 boys names and 50 girls names. Everyone who signs up gets one of each, allowing for 2,500 unique combinations. [Editor’s note]…

[DKTastic]

Thank you all. I’m certain the main issue was with my registrar and not with cloudflare.