Subdomain Shadowing
< BLOG
Subdomain Shadowing
Subdomain shadowing is a simple web-address trick used to make a fraudulent website appear connected to a trusted company. It relies on putting a recognised brand or company name at the beginning of a longer address, where many people naturally look first.
For example:
- yourcompany.com.risk.com
At a glance, this may look as though it belongs to yourcompany.com. It does not. The real domain is risk.com, and yourcompany.com is only a subdomain controlled by whoever owns risk.com.
What is subdomain shadowing?
Subdomain shadowing is a pattern where an attacker places the web address of the organisation they are copying into a subdomain of a domain they control.
A web address is read from right to left when identifying who controls it:
- yourcompany.com.risk.com
.com is the top-level domain
risk.com is the registered domain
yourcompany.com is a subdomain of risk.com
The owner of risk.com can create almost any subdomain they want, including one that contains your business name, your website address or a customer portal reference.
That means an attacker could create addresses such as:
- yourcompany.com.login.risk.com
- secure.yourcompany.com.risk.com
- yourcompany.co.uk.risk.com
- accounts.yourcompany.com.risk.com
None of these are controlled by your company unless you own the final registered domain.
Why subdomain shadowing works
Most people do not analyse a web address closely, particularly when they arrive through an email, text message, paid advert or social-media message.
They see a familiar name at the start:
- yourcompany.com.risk.com
Their first impression is often: “This looks like it came from yourcompany.com.”
That is exactly what the attacker wants. Using your company name at the front of the address gives the fraudulent website a degree of credibility before the visitor has checked where the link really leads.
Subdomain shadowing is especially effective when the attacker also copies your branding, logo, colours, sign-in page or contact details. The web address helps get the visitor through the door; the copied website then does the rest.
The key rule: check the real domain
To identify who controls a web address, look at the final domain immediately before the top-level domain.
In this example:
- yourcompany.com.risk.com
The important part is:
- risk.com
Not:
- yourcompany.com
A legitimate address owned by your business would normally end with your actual domain:
- portal.yourcompany.com
- login.yourcompany.com
- support.yourcompany.co.uk
Here, yourcompany.com or yourcompany.co.uk is the real domain. The word before it is simply a subdomain that your business has created.
| Address | Real domain | Likely controlled by |
|---|---|---|
| login.yourcompany.com | yourcompany.com | Your company |
| support.yourcompany.co.uk | yourcompany.co.uk | Your company |
| yourcompany.com.risk.com | risk.com | Owner of risk.com |
| secure-yourcompany.risk.com | risk.com | Owner of risk.com |
How criminals use subdomain shadowing
Subdomain shadowing is commonly used as part of broader impersonation and phishing activity. An attacker may use it to:
- Send fake invoice or payment requests
- Create false customer-login pages
- Imitate Microsoft 365, banking or supplier portals
- Target employees with credential-harvesting emails
- Support CEO fraud or supplier-payment diversion attempts
- Make a malicious link appear more trustworthy in a message or advert
A criminal does not need to compromise your real domain to do this. They only need to register or control another domain and create convincing subdomains beneath it. That makes subdomain shadowing a low-cost tactic with potentially serious consequences for businesses whose names are being copied.
How to protect your business
You cannot stop someone from writing your company name into a subdomain on a domain they own. However, you can reduce the chance of customers or staff being fooled and improve your ability to respond.
Monitor for suspicious web addresses
Monitor new domains and subdomains that include:
- Your company name
- Your primary domain name
- Common misspellings
- Product names
- Brand names
Terms such as “login”, “secure”, “accounts”, “support”, “payment” and “verify”
Early detection gives you more time to assess whether a site is copying your brand, collecting credentials or targeting your customers.
Tell customers where to sign in
Make it clear which web addresses you use for customer accounts, payments and support.
For example, state on your website and customer emails:
- We will only ask you to sign in through addresses ending in yourcompany.com.
This helps customers understand that yourcompany.com.risk.com is not a legitimate company website.
Train staff to read links carefully
Employees should be cautious with links in emails, messages and documents, particularly where the message involves payments, password resets, login requests or urgent action.
Before entering credentials or payment details, they should check the end of the web address, not just the company name displayed at the beginning.
Report impersonation quickly
If you find a suspicious website using subdomain shadowing, preserve evidence before it disappears:
- The complete web address
- Screenshots of the webpage
- The date and time it was found
- The email, message or advert containing the link
- Any copied logos, text, contact details or login forms
- Technical details such as hosting provider, registrar and IP address where available
This information supports reporting to the domain registrar, hosting provider, browser safety services and relevant authorities.
It is what it is
Subdomain shadowing works because people tend to trust the familiar company name at the start of a web address. But in a link such as:
- yourcompany.com.risk.com
the real domain is risk.com, not yourcompany.com.
Businesses should monitor for misleading addresses, educate staff and customers, and act quickly when impersonation is found. A convincing-looking subdomain can be enough to support phishing, payment fraud or credential theft, even when your real website has not been compromised.
