7 ms·

Is it an accident? No, it's a wildcard subdomain

55 points by TuxMulder 11y ago

MrSourz 11y ago
I think this is a good demo to share with family and am glad this organization has c.uk. Another more general example to share with family is: http://www2.scotiaonline.scotiabank.com.online.authentication.authentication.bns.c.uk/ http://www2.scotiaonline.scotiabank.com.online.authenticatio... These are both cases where the subdomain can trick people. The .c.uk one is a bit more dangerous as they claim a lot of people end up landing on those pages. I had a quick look through some other second level domains to see if anyone else had a site like this. The more details on two level domains here: http://en.wikipedia.org/wiki/Second-level_domain http://en.wikipedia.org/wiki/Second-level_domain
- MrSourz 11y ago
  What I find hard to believe and just realized was that this domain was registered on 10-Jun-2014. Edit: People were first able to register .uk domains last year, and if the .co.uk domain already exists then you must own it in order to register the .uk domain.
  - 0x0 11y ago
    Direct registrations under .uk (and not just .co.uk, .org.uk etc) were only opened last year.
    - MrSourz 11y ago
      That explains it; I was completely baffled. I wonder how much of a bidding war there was for this domain.
      - MatthewWilkes 11y ago
        The owner of the .co.uk has first dibs, so in this case there was no bidding war.
    - deleted 11y ago
      [deleted]
cbd1984 11y ago
Interesting that they would allow such an odd domain to be registered in the first place. It seems like a big security hole.
- MatthewWilkes 11y ago
  Why is that interesting? c.uk is a registered domain, the WHOIS for subdomains correctly states that it can't be registered.
  - cbd1984 11y ago
    > Why is that interesting? Because I found it interesting.
    - ars 11y ago
      No, he means what do you find unusual about it. It seems like an ordinary name to me. Is it that it seems too easy to typo?
      - GSimon 11y ago
        > No, he means what do you find unusual about it > It seems like a big security hole.
        MatthewWilkes 11y ago
        The problem with c.uk. being an allowed domain is, I agree, very dodgy. This thread is about the WHOIS returning that it's not responsible for foo.c.uk. though which is absolutely what I'd expect.
  - Yelwis 11y ago
    Because .UK only allowed registrations at the third level for decades, i.e. example.co.uk, example.ac.uk etc. I think it's also the most-used CCTLD. Then they introduced second level domains, but they're still rarely used at present. ebay.uk and google.uk are registered, but don't do anything yet.
AshleysBrain 11y ago
I didn't know single letter domains were allowed? For example none of a.com, b.com, c.com etc. work - do other gTLD allow single letter domains then?
- 0x0 11y ago
  X.org is pretty well known
- TheDong 11y ago
  https://t.co/ https://t.co/ is very well known. Probably the most used single-character domain in existence :) Unrelated, but I've never understood why t.co counts against your tweet length.. for example, if you tweeted "ebay.c.uk", it would count for length(http://t.co/xxxxxxxxxx http://t.co/xxxxxxxxxx) characters (15 characters even though you only typed 9).
  - TheLoneWolfling 11y ago
    Related: http://qntm.org/twit http://qntm.org/twit
    - calebegg 11y ago
      > This was the case as of 2011-08-16 [...] I'll let them know about it tomorrow and I expect it'll be rectified in a day or two Quite optimistic :-) especially since the situation has gotten worse by two characters since then.
  - dmart 11y ago
    According to Twitter, t.co is mandatory in order to prevent phishing and calculate link popularity: https://support.twitter.com/articles/109623 https://support.twitter.com/articles/109623
    - TheDong 11y ago
      I'm not asking why they use t.co. I'm asking why it counts against my tweet length. If I want to tweet 140 characters and they interpret some of them as a link, why can I no longer tweet my 140 characters because something on their system turned it into 150 characters? They could shorten it while still using my url's length for accounting. They already let you tweet more than 140 bytes due to unicode so it's clearly not a technical reason such as a char(140) db column. They very well could simply take min(len(t.co/url), len(orig_url)) without breaking any past tweets or changing the 140 character limit's spirit. It would just behave more logically.
eric59 11y ago
How is a wildcard subdomain configured?
- MrSourz 11y ago
  A simple DNS configuration would be: An A record * .domain.com -> IP address and in Nginx on the server with that IP address server { listen 80; server_name domain.com *.domain.com;
- datenwolf 11y ago
  Have the glue record for a/your domain (e.g. c.uk) point to your own nameserver. Configure the nameserver to respond to any request for an A or AAAA record under that domain with the target IP address. Make the HTTP server listening on that IP address answer regardless of the Host header.
- TheDong 11y ago
  It depends on your DNS provider as to if they support it or not. Often, they will not and you'll simply have to run your own dns nameserver (bind) with a wildcard config, such as http://community.aegirproject.org/dnswildcard http://community.aegirproject.org/dnswildcard ... Googling around will find you many bind configurations and discussions of this feature.
- nav1 11y ago
  Something along lines of * IN A <ip_address>
xg15 11y ago
So, does this mean, I can buy com.uk and edu.uk now?
- Yelwis 11y ago
  Error for "com.uk". This domain cannot be registered because it contravenes the Nominet UK naming rules. The reason is: third-level domains may not be identical to a top-level domain. WHOIS lookup made at 00:32:52 13-Apr-2015 But edu.uk is available for the owner of edu.co.uk. Other 2-3 letter domains seem to have been squatted (I tried several ISO codes and some newer generic TLDs).
- gabeio 11y ago
  You could buy e.uk and catch typos like <college>.e.uk with the same page!
  - mizzao 11y ago
    It's ac.uk for "academic".
    - gabeio 11y ago
      then *.a.uk
- nattofriends 11y ago
  You would fool no one because the UK uses *.ac.uk for academic institutions.
pidg 11y ago
Another fantastic outcome of non-profit (lol) Nominet's recent, desperate attempts to squeeze every last penny out of the .uk tld.
Jodie_C 11y ago
There was an ok.su that would accept any traffic sent its way: mail, web, im, dns, so on. I often wonder how many errors sent ok.us traffic to that black hole, and what they did with the data. I assume there are several other .su domains set up with blackholes as well.

55 points by TuxMulder 11y ago

I think this is a good demo to share with family and am glad this organization has c.uk. Another more general example to share with family is: http://www2.scotiaonline.scotiabank.com.online.authentication.authentication.bns.c.uk/ http://www2.scotiaonline.scotiabank.com.online.authenticatio... These are both cases where the subdomain can trick people. The .c.uk one is a bit more dangerous as they claim a lot of people end up landing on those pages. I had a quick look through some other second level domains to see if anyone else had a site like this. The more details on two level domains here: http://en.wikipedia.org/wiki/Second-level_domain http://en.wikipedia.org/wiki/Second-level_domain

MrSourz 11y ago
What I find hard to believe and just realized was that this domain was registered on 10-Jun-2014. Edit: People were first able to register .uk domains last year, and if the .co.uk domain already exists then you must own it in order to register the .uk domain.
- 0x0 11y ago
  Direct registrations under .uk (and not just .co.uk, .org.uk etc) were only opened last year.
  - MrSourz 11y ago
    That explains it; I was completely baffled. I wonder how much of a bidding war there was for this domain.
    - MatthewWilkes 11y ago
      The owner of the .co.uk has first dibs, so in this case there was no bidding war.
  - deleted 11y ago
    [deleted]

cbd1984 11y ago

Interesting that they would allow such an odd domain to be registered in the first place. It seems like a big security hole.

MatthewWilkes 11y ago
Why is that interesting? c.uk is a registered domain, the WHOIS for subdomains correctly states that it can't be registered.
- cbd1984 11y ago
  > Why is that interesting? Because I found it interesting.
  - ars 11y ago
    No, he means what do you find unusual about it. It seems like an ordinary name to me. Is it that it seems too easy to typo?
    - GSimon 11y ago
      > No, he means what do you find unusual about it > It seems like a big security hole.
      - MatthewWilkes 11y ago
        The problem with c.uk. being an allowed domain is, I agree, very dodgy. This thread is about the WHOIS returning that it's not responsible for foo.c.uk. though which is absolutely what I'd expect.
- Yelwis 11y ago
  Because .UK only allowed registrations at the third level for decades, i.e. example.co.uk, example.ac.uk etc. I think it's also the most-used CCTLD. Then they introduced second level domains, but they're still rarely used at present. ebay.uk and google.uk are registered, but don't do anything yet.

AshleysBrain 11y ago

I didn't know single letter domains were allowed? For example none of a.com, b.com, c.com etc. work - do other gTLD allow single letter domains then?

0x0 11y ago
X.org is pretty well known
TheDong 11y ago
https://t.co/ https://t.co/ is very well known. Probably the most used single-character domain in existence :) Unrelated, but I've never understood why t.co counts against your tweet length.. for example, if you tweeted "ebay.c.uk", it would count for length(http://t.co/xxxxxxxxxx http://t.co/xxxxxxxxxx) characters (15 characters even though you only typed 9).
- TheLoneWolfling 11y ago
  Related: http://qntm.org/twit http://qntm.org/twit
  - calebegg 11y ago
    > This was the case as of 2011-08-16 [...] I'll let them know about it tomorrow and I expect it'll be rectified in a day or two Quite optimistic :-) especially since the situation has gotten worse by two characters since then.
- dmart 11y ago
  According to Twitter, t.co is mandatory in order to prevent phishing and calculate link popularity: https://support.twitter.com/articles/109623 https://support.twitter.com/articles/109623
  - TheDong 11y ago
    I'm not asking why they use t.co. I'm asking why it counts against my tweet length. If I want to tweet 140 characters and they interpret some of them as a link, why can I no longer tweet my 140 characters because something on their system turned it into 150 characters? They could shorten it while still using my url's length for accounting. They already let you tweet more than 140 bytes due to unicode so it's clearly not a technical reason such as a char(140) db column. They very well could simply take min(len(t.co/url), len(orig_url)) without breaking any past tweets or changing the 140 character limit's spirit. It would just behave more logically.

eric59 11y ago

How is a wildcard subdomain configured?

MrSourz 11y ago
A simple DNS configuration would be: An A record * .domain.com -> IP address and in Nginx on the server with that IP address server { listen 80; server_name domain.com *.domain.com;
datenwolf 11y ago
Have the glue record for a/your domain (e.g. c.uk) point to your own nameserver. Configure the nameserver to respond to any request for an A or AAAA record under that domain with the target IP address. Make the HTTP server listening on that IP address answer regardless of the Host header.
TheDong 11y ago
It depends on your DNS provider as to if they support it or not. Often, they will not and you'll simply have to run your own dns nameserver (bind) with a wildcard config, such as http://community.aegirproject.org/dnswildcard http://community.aegirproject.org/dnswildcard ... Googling around will find you many bind configurations and discussions of this feature.
nav1 11y ago
Something along lines of * IN A <ip_address>

xg15 11y ago

So, does this mean, I can buy com.uk and edu.uk now?

Yelwis 11y ago
Error for "com.uk". This domain cannot be registered because it contravenes the Nominet UK naming rules. The reason is: third-level domains may not be identical to a top-level domain. WHOIS lookup made at 00:32:52 13-Apr-2015 But edu.uk is available for the owner of edu.co.uk. Other 2-3 letter domains seem to have been squatted (I tried several ISO codes and some newer generic TLDs).
gabeio 11y ago
You could buy e.uk and catch typos like <college>.e.uk with the same page!
- mizzao 11y ago
  It's ac.uk for "academic".
  - gabeio 11y ago
    then *.a.uk
nattofriends 11y ago
You would fool no one because the UK uses *.ac.uk for academic institutions.

pidg 11y ago

Another fantastic outcome of non-profit (lol) Nominet's recent, desperate attempts to squeeze every last penny out of the .uk tld.

Jodie_C 11y ago

There was an ok.su that would accept any traffic sent its way: mail, web, im, dns, so on. I often wonder how many errors sent ok.us traffic to that black hole, and what they did with the data. I assume there are several other .su domains set up with blackholes as well.