Xañ tur domen, dangar DNS, ak tëju registrar¶

Ñàkka mëna yor sa tur domen bu njëkk ci sa mbootaay wala zone DNS bu am kàttan, bokk na ci jafe-jafe yi gëna gàlankoor liggéey, hopitaal, agence municipale, wala piblikaasioŋ ci net bi. Ndax sa tur domen mooy root confiance ci bépp sistem ci net bi, songekat biy jàpp sa kontu registrar domen wala dangar sa dokimaa DNS du yàq sa sitweb kese. ay simili yu néew ginaaw boo soppi sa NS (Serwëru tur), A/AAAA (IP Web), wala MX (Mail Exchange) dokimaa, songekat bi mën na jàpp ci noppi bépp imeel bu liggéeyukaay bi ak kiliyaan biy dugg, jaar ci otomatik Nanu Encrypte Domain Validation (DV) xool ngir am sertifikaa encryption TLS/SSL bu baax ci sa tur, jàpp baatu-jàll Single Sign-On (SSO) liggéeykat, ba noppi génne imeel yuy reset baatu-jàll ngir sa infrastructure cloud, portalu bànk, ak kontu xaalis. Ba ci benn njuumte bu amul benn loraange, lu melni domen bu jeex daanu ci AutoRenewGracePeriod wala RedemptionPeriod (clientHold), dafay indi dem bi ak dikk bi ci web bi, backend mobile API yi, ak imeel liggéeyukaay yi ci saasi ci àdduna bi yépp.

Sudee dañu jàpp domen bi wala DNS bi dafay gàllankoor yoonu malaad yi ci hopitaal bi, jokkoog dispatch urgent, telemetry utilite publik, wala sistemu kaaraange dundu buy dox, woo sa nimero urgent bi la gëna jege (911 ci Etats Unis ak Canada, 112 ci biir Mbootaayu Orop, 999 ci Royaume-Uni) wala nga seet sunu limu internasional nimero paj mu jamp ak yëgal sa ekip nasonaal buy tontu ci jafe-jafe siber (lu melni CISA ci Etats Unis ci 1-844-SAY-CISA wala NCSC ci Royaume-Uni) ci saasi. Ngir bépp jafe-jafe bu jëm ci wàllu jënd ak jaay, liggéey buy def te Yàlla tax, ak jafe-jafe domen bopp, defal jéego yii ñu bind ci suuf ci yoon wu jaar yoon.

Defal lii leegi¶

1. Xam ci 30 seconde ndax sa domen jeexna, sa dokimaa DNS soppiku nañu ko, wala domen bi dañu ko toxal ab registrar bu bawoo feneen: Doxal ab live RDAP wala WHOIS laaj ak laaj DNS bu am sañ-sañ bu bawoo ci ab terminal (rdap yourdomain.com wala whois yourdomain.com, ak dig +trace yourdomain.com). Saytu Turu Bindkat bi, Kodu Status EPP (lu melni clientHold ngir faktiir/xool vs. ok ak serwëru tur yi nga xamul), ak Serwëru tur yu am sañ-sañ (NS).
2. Congelé bépp reset baatu-jàll buy dem te tëj sa joxekatu dàntite (Okta, ID Microsoft Entra, Barabu liggéeyu Google) ci saasi: Sudee ab songekat moo yor sa domen MX dokimaa wala NS serwër yi, dañuy jot bépp imeel buñu yonne ci *@yourdomain.com. Waxal ci saasi sa administratër IT ñu dindi "Fàtte baatu-jàll ci Imeel" reset self-service ci jumtukaayi liggéeyukaay yépp, dindi sesioŋ yi am ci jëfandikukat yi seen adres email mëna jëfandikoo ngir reset kontu jaaykat yu biti, ba noppi soppi dugg administratif yi ci hardware FIDO2 caabi kaaraange yi ci biir wala .onmicrosoft.com domen yu ñuy delloo.
3. Sàmm nataali forensiik yu mat te leer ci RDAP/WHOIS, zone DNS, ak leer gi ci sertifikaa bi (CT) logs balaa dara di soppeeku: Sanc li génn ci dig ANY yourdomain.com @8.8.8.8, whois yourdomain.com, nga xool crt.sh/?q=%25.yourdomain.com ci saasi. Seetug crt.sh dafay wane bépp sertifikaa SSL/TLS buñu mayul ndigal, te songekat bi defar ko ngir say domen yu ndaw (mail., vpn., login., api.) suko defee nga xam bu baax ban sarwis interne lañuy niru ak seeni proxy ci Adversary-in-the-Middle (AitM).
4. Jokkoo ak ekipu Operaasioŋu Kaaraange / Kaaraange giñ jagleel Registrar biy ñàkk (buñu Tier-1 ndimmbalu waxtaan) ngir génne ICANN Xeex Transfer buñu Mayul (IRTP) wala Registry Lock reversal: Sudee dañu puus sa domen ci beneen kontu ci benn registrar bi wala ñu toxal ko ci sàcc Auth-Info (EPP) kodu ab registraire bu bawoo feneen, jokkool ak sa registraire bi njëkk Domain Abuse / Biro buy Yokkateg Kaaraange bu Risk bu rëy te nga laaj ci saasi Registrar bi Delloosi / Juuyoo ci Toxal ci Jafe-jafe ci wàllu ICANN Transfer Policy (Section I.A ak Transfer Dispute Resolution Policy), di wax ci njuumteg gëm-gëm buñu mayul ndigal.
5. Demal ci Operatëru Domen bi gëna kawe (TLD) sudee bindkat bi tontuwul: Fatteliku hierarchie bi: Bindukat yi (lu melni GoDaddy, Namecheap, Cloudflare, MarkMonitor, Solutions Reseau, Gandi, Porkbun) jaaykat yu ndaw lañu; Operatëru Registre (lu melni Verisign ngir .com/.net, Registre d'intérêt publique (PIR) ngir .org, Tànn ngir .uk, CIRA ngir .ca, DENIK ngir .de, wala ** auda** ngir .au) dafay doxal base de done zone root bu mag bi. Kodu réew (ccTLD) registre yi ak registre gTLD yu bari mën nañu indi jafe-jafe serverHold wala serverUpdateProhibited tëjug ci niveau root bi ci jamonoy jafe-jafe cybercrime yuñ firndeel.
6. Àrtu kiliyaan yi, jaaykat yi ak naataango bànk yi jaaraleko ci chaine yi nekk ci biti @yourdomain.com email bi dafa am jafe-jafe: Sudee ki la song dafa jàpp sa MX dokimaa, dina ñu tontu ci saasi ci ubbi thread kontabilite ak njuuj njaaj ci joxe xaalis. Yegal kiliyaan yi jaaraleko ci telefon, SMS, LinkedIn, xëtu tolluwaayu domen bu wuute, wala kontu reso sosio ofisel ñu baña wóolu benn imeel wala portaalu dugg ci domen biñ laal ba keroog ñuy firndeel defaraat bi.

Garab dogal: saytu ak denc ab domen wala DNS buy dog¶

Toppal bii diagram diagnostic bu gaaw ngir xam bu baax layer bi ci Sistemu Turu Domen bi lajj wala ñu jàpp ko:

flowchart TD
    A["Sitweb bi dafa wàcci, Àrtu ci Sàrtifikaa TLS, wala Imeel liggéeyukaay bi dafa taxaw"] --> B["Doxal RDAP/WHOIS & gas +topp ci Reseau bitti"]
    B --> C{"Luy wane tolluwaayu RDAP ak barabi bindkat yi?"}
    C -->|"Status: clientHold, diiru yeesal sa bopp, wala diiru jëlaat"| D["Expiration bu jaarul yoon wala ICANN Whois"]
    D --> E["Duggal ci Registrar ci saasi: Feesal yeesal / jëlaat xaalis wala nga bës RAA Lien Verification; Laaj TTL Flush ci jamonoy jafe-jafe"]
    C -->|"Tur bindukat bi wala kontu bindukat bi soppiku te kenn mayu ko ndigal"| F["Hijack kontu Registrar bu mat wala joxe EPP buñu mayul ndigal"]
    F --> G["Tëjug joxekatu dàntite (Duggal/Google), Dosie Tiketu Njaayum Sekkoor + ICANN Xeexal Toxal, Xool crt.sh ngir Cert Rogue"]
    C -->|"Registrar & NS soppiku wuñu, waaye A / CNAME / MX dafay wane IP yuñu xamul"| H["Fournisseur DNS buñ yor (Cloudflare / Route53 / Caabi API NS1 wala sàcc kontu)"]
    H --> I["Boole DNS API Token yiñ laal, Defaraat Fichier Zone bu Baax, Boole Rogue TLS Certs, Wecci Njàngat yiñ wane"]
    C -->|"Registrar, NS, ak dokimaa zone dañu nuru lu jaadu, waaye sit bi daa lajj ndax SERVFAIL"| J["DNSSEC chaine de confiance bu yàqu (DS Record bu méngoowul wala RRSIG bu jeex)"]
    J --> K["Doxal DNSViz.net Saytu: Dindi dokimaa DS yu yàgg yi ci bindkat bi wala nga siñewaat zone bi ci DNS Host"]

Faas 1: Forensics teknik ngir xàmmee vecteur attaque bi¶

Su domen bi taxawee ci saasi wala mu tàmbali liggéey ci xëtu phishing wala scam cryptocurrency, simili bu nekk booy def ngir xalaat dafay yàq jotu defaraat bu am solo. Amna ñeenti senaario yu wuute lool yu nuru jëfandikukat bu mujj ci nawigatër web, te bu nekk ci ñoom mingi soxla saafara bu wuute lool.

Ni ñuy jàngee RDAP, WHOIS, ak dig Sorti yu melni ab tontukat ci jafe-jafe¶

Ubbi ab terminalu komànd ci Linux, macOS, wala Windows (jëfandikoo WSL wala nslookup) nga def ñatti saytu yi ci topp, nga jëfandikoo benn résolver recursif publik bu amul benn boor (8.8.8.8 wala 1.1.1.1):

1. Xool Delegaasioŋ bi ci niveau Registre bi (dig +trace ak RDAP):

   dig +trace yourdomain.com NS @1.1.1.1
   

   • Xoolal jéego yi ci ginaaw serveur root TLD yi (ci misaal, a.gtld-servers.net. ngir .com). Ban NS (Serwëru tur) tur yi ñuy delloo ci Registre TLD bi ci boppam?
   • Sudee TLD Registry dafay delloo sa serwëru tur yi (ns1.yourdnsprovider.com) ak statut NOERROR, hijack bi mingi am ** ci biir sa fournisër DNS ** (wala DNSSEC bu yàqu).
   • Sudee Registre TLD bi dafay delloo serwëru tur yiñ xamul (wala sudee whois yourdomain.com dafay wane lu bees Registrar: tur ak benn Updated Date: ci waxtu wala fan yu néew yi weesu), jàpp bi dafa am ci niveau Registrar Domaine.
2. Dekode kodu tolluwaayu domen ICANN EPP: Xoolal Domain Status: liiñ yi ci sa WHOIS wala RDAP génne. Yii kodu Protokolu Yokkateg Yokkateg (EPP) dañu lay wax li waral domen bi di lajj wala di tëju:

2ème étape: Recuperation ci hijack domen bu ñaaw wala toxal registrar buñu mayul ndigal¶

Congkat yi dañuy jàpp liggéeyukaay yu am solo, Web3/DeFi, xaalis, ak domen media yi ci jëfandikoo ñetti pexe yu njëkk: 1. **Jëfandikoo kontu bindukat bi (Fësal ay leeral, sàcc xibaar, wala weccoo SIM) **: Ki lay song dugg na ci sa GoDaddy, Namecheap, Google Domains/Squarespace, wala tablo Solution Reseau, dafay fay clientTransferProhibited, soppi NS enregistrement ngir joxoñ benn kontu Cloudflare bu songekat bi yor, wala defar benn Auth-Info (EPP) kodu toxal domen bi ci biti. 2. Ingénieur sosiaal bu jàppale Sekkerteer: Kiy song dafay joxe këyitu sosiete bu baaxul, ID nguur yu baaxul, wala boppu bataaxal buñ naxaate ci biro biy jëlaat kontu sekretëri bi di wax ni admin IT bi njëkk daa dee wala dafa bàyyi liggéeyukaay bi. 3. Jëfandikoo subdomaine (Dangling CNAME / Dangling NS): Sa domen bu mag bi laalul, waaye domen bu ndaw la (promo.yourdomain.com wala status.yourdomain.com) ba leegi amna CNAME enregistrement buy wane ab seau AWS S3 buñu delloo liggéey, Serwiisu Aplikaasioŋu Azure, repo Xëti GitHub, aplikaasioŋu Heroku, wala misaalu Zendesk bi nga efaase ay weer ci ginaaw. Cong bi dafay bind tur wiñ bàyyi ci AWS/Azure/GitHub ba noppi ci saasi mu joxe ëmbiit yu bonn yi bawoo ci sa subdomain ofisel.

Jéego 1: Dëddu ki la song ci sa fournisër dàntite Cloud ak sa sistem imeel¶

Laata ngay jeexal bind formileeru recuperation registrar, jàpp ni ki lay song mingi jàng bu baax bépp imeel buñu yonne sa domen ba noppi di jéema pivot ci sa infrastructure cloud bi ci biir:

1. **Soppi Microsoft 365 / Barabu liggéeyu Google ci Domen yu ñuy delloo ak MFA **:
   • Ci ID Microsoft Entra (Azure AD bu njëkk), bépp luwekat amna domen buy yàgg te kenn mënu ko xañ (yourcompany.onmicrosoft.com). Administratër yi mën nañu dugg ci admin@yourcompany.onmicrosoft.com doonte yourdomain.com DNS dañu ko jàpp lëmm.
   • Def bépp SMS, woote baat, ak yeneen pexe ngir reset baatu-jàll imeel ci Entra ID / Okta / Barabu liggéeyu Google (Authentication Methods Policy). Dafay laaj Caabi kaaraange aparey FIDO2/WebAuthn wala yëgle push bu méngoo ak nimero.
2. Xool Imeel yiy dem ak yiy dugg ngir palanteer bi gëna jub:
   • Sudee sa MX dokimaa yi soppiku nañu ci 02:14 UTC, amul benn imeel bu baax bu bawoo ci biti bu yegg ci sa serwëru mail dëgg li ko dalee 02:14 UTC; bépp imeel bu bawoo biti buñu yonne sa liggéeykat ci palanteer boobu, serwëru mail bu soxor bi (Postfix/Exim listener) daf ko jàpp ci mbind mu leer.
   • Ci saasi génne limu bépp platform SaaS bu nekk ci digante yenen, bànk, kontu root AWS/GCP, mbootaay GitHub, ak portaalu jaaykat buñ takk ci @yourdomain.com adres email, nga xool ndax songekat bi dafa def reset baatu-jàll ci platform yi ci biti ci palanteeru jàpp bi.

Jéego 2: Defal Registrar ak Protokolu Recuperation Emergency Registry¶

Bul ubbi ab chat buy jàppale "Sama sitweb doxul". Danga wara jëfandikoo kàddu yiñ tëral ak sàrt yiñ tëral ngir mëna dem ba ci Kaaraange Registrar Tier-3 / Konseye Général / Ekipu sàmmonte ICANN:

1. Case A: Domaine baa ngi ci sa Registrar bi njëkk (Jël kontu bi wala "Push kontu bi ci biir):
   • Barina ñiy song duñu xaar 5 fan ngir ñu jox leen EPP ci seen biir; lu moy loolu, dañu jëfandikoo man-manu registrar bi ci saasi "Push Domain ci beneen kontu" ngir toxal sa domen ci kontu burner ci benn registrar ci 3 seconde.
   • Woowal te bataaxal ci saasi Departemaa biy saytu njuuj njaaj / xajamal kontu / yàqu-yàqu ci saasi. Wax leen bu leer: "JAAW KAARAANGE BU GAAW: Dugg ci kontu buñu mayul ndigal ak Domen bi ci biir Push / DNS Coppite ci [yourdomain.com]. Laajte ci saasi domen bi ci suufu serverHold/clientUpdateProhibited ak delloosi coppite DNS/Kontu yiñ nanguwul."
   • Dajaleel sa firnde ci taarixu moomeel Paket ci saasi: Ekipu kaaraange Registrar yi dañuy laaj firnde bu wóor ni yaay ki njëkka bind laata ñuy dindi domen ci beneen kontu. Dajalel 5 këyit yii ci benn PDF ci saasi:
     1. Factures Registrar Historique ak Firnde Fay: Resit PDF ak kàrtu kredi / statement bànk buy wane ni sa mbootaay dafay fay ngir bind ak yeesal yourdomain.com ci 1 ba 10 at yi weesu (boole ci 4 lim yu mujj yi ci kàrtu fayukaay bi wala royuwaay bi).
     2. Bindu liggéeyukaay bi nguur gi joxe ak ID ofisiye: Sàrtifikaa ofisel buy wane ni dañu dugal liggéeyukaay bi / sàrti liggéeyukaay bi méngoo ak taarixu WHOIS Registrant Organization, boole ci kàrtu ID bu am nataalu nguur gi, di kilifag liggéeyukaay bi siñe afidaavi bi.
     3. Fichier Zone DNS Historique & Firnde Boroom Serveur: Kopi fichier zone DNS bi njëkk, nataali WHOIS yu yàgg, wala firnde ni sa mbootaay moo yor sistem biy demal boppam (ASN) wala bloke IP (A dokimaa) yu domen bi doon joxoñ ay at ci ginaaw coppite tay.
     4. Imeel biy sos kontu bi njëkk / Jaar-jaaru tikeet: Boppu imeel yiñ jote ci registrar bi ci jamono ji ñu njëkka bind wala yeesal domen bi.
     5. Nimero Rapport Ofisel bu Yoon: FBI IC3 (ic3.gov) nimero plainte (Etats Unis), Njuuj njaaj nimero royuwaay (Royaume-Uni), wala nimero rapooru krim siber bu poliis nasonaal. Bindukat yi ñoo gëna gaaw suñu leen joxee nimero dosiye bu mat sëkk buy firndeel ni dañu dugg ci ordinatër ci wàllu krim ci wàllu 18 U.S.C. § 1030 (CFAA) wala Sàrtu Jëfandikoo Ordinatër bu baaxul bu 1990 ci UK.
2. Case B: Dañu toxal domen bi ci beneen bindukat (Hijack ci diggante bindukat yi):
   • Ci wàllu ICANN Politigu Toxal (IRTP bu njëkk), toxal ci diggante registrar yi dafay laaj Auth-Info (EPP) kode te dañu ko wara tëj ci diiru 60 fan ginaaw bi yenn coppite yu bindkat bi defee fileek ñu baalewul. Sudee ab songekat dafa pirate sa kontu ci Sekker A ("Sekker biy ñàkk") ba noppi toxal domen bi ci Sekker B ("Sekker bi am"):
   • Jokkoo ak Sekkerteer bi ñàkk ak Sekkerteer bi am xaalis ci saasi, waaye njëkkal Xaajalug Toxal Sekkerteer bi ñàkk / Ekipu Kaaraange. Ci wàllu ICANN Politig buy saafara jafe-jafe ci wàllu toxal (TDRP), Registrar biy ñàkk mooy mbootaay bi yor sa dokimaa faktiir yu njëkk ya ak say done yu dugg yuy firndeel ni toxal bi amul ndigal. Sekretër bi ñàkk mën na jokkool ak kilifa gi yor sàmmonte ak sàrt yi ci Sekretër bi am xaalis ngir def benn koperatiif Delloosi Toxal Sekretër, wala def ab dosiye TDRP bu mat sëkk.
   • Ci saasi yonneel sa këyit buy firndeel ni yaay boroom bi ak rapooru poliis bi ci Biro buy saytu fitnaal bu Sekretëru Gaining nga sàkku ci ñoom ñu joxe ci saasi clientTransferProhibited ak clientUpdateProhibited tëj domen bi suko defee ki koy song mënatul dugg ci domen bi jaare ko ci ñetti yeneen registrar yu nekk ci tefes gi ("jël registrar").
3. Delloo ab Eskalaasioŋ bu Jafe-jafe ci ICANN (ngir gTLD yu melni .com, .net, .org, .io sudee gTLD) wala Bindu ccTLD:
   • Sudee registrar bi nanguwul amal lànket ci ab toxal buñu mayul ndigal wala mu baña tontu ci jamonoy xajamal, yonneel ab gaaw Toxal buñu mayul ndigal / Plainte ci xajamal domen jaaraleko ci ICANN Contractual Compliance Portal (icann.org/compliance/complaint).
   • Sudee sa domen dafay jëfandikoo Kodu-Réew Domen bu gëna kawe (ccTLD), lu melni .uk, .ca, .au, .de, .fr, .nl, .ch, wala .jp, am nga tànneef bu gëna gaaw: ccTLD registri yi njiiti réew mi ñoo leen di yoree, du ICANN te daanaka saa yu nekk dañuy tëye Ekipu Kaaraange Emergency Registry (ci misaal, Nominet ci UK ci 0330 236 9470, CIRA ci Canada, DENIC ci Allemagne, AFNIC ci France) yu mëna tëj domen buñ jàpp ci registre national ci diir bu gàtt ginaaw buñu xoolee dàntite liggéeyukaay bi.

3ème étape: rëcci ab domen bu jeexal (clientHold, RedemptionPeriod, ak PendingDelete)¶

Du bépp dogg bu gaaw ci àdduna bi mooy cyberattack. Bis bu nekk, liggéeyukaay yu mag yi, SaaS startups, ak kontraktuwel yu nguur gi dañuy dem lëndëm ndax kàrtu kredi bi ci dosiye bi ci seen registrar domen bi jeexna, ba noppi ñu yónnee imeel yiy fàttali nit ñi ñu yeesal former-founder@company.com mu bàyyi liggéeyukaay bi defna ñetti at.

Xam kalendriye dundu domen bi ICANN jeex¶

Ngir domen yu gëna kawe (.com, .net, .org, .biz, .info), ICANN Politigu Recuperation Bind bu jeex (ERRP) dafay tëral dundu gu bari etape yu tar ginaaw bi bis bi jeex weesee:

1. Etape 1: Diiru yeesal boppam (Bis 1 ba ~30/45 ginaaw bimu jeexee):
   • Ginaaw bi domen bi jeexee ci saasi (muy faral di nekk ci diir bu weesuwul 24 ba 72 waxtu), registrar bi dafay soppi domen bi NS enregistre ci Xëtu Splash bu Yeesal bu Gaare / Expired wala nga dugal domen bi ci clientHold.
   • Impact: Sa sitweb ak sa imeel liggéeyukaay dañuy bàyyi liggéey ci saasi (DNS_PROBE_FINISHED_NXDOMAIN wala yëgle ci gaaraas yi).
   • Delloosi: Duggal ci kontu registrar bi nga fay fere yi ñuy yeesal ci diiru benn at ($10 ba $30 USD). Sekretër bi dafay delloosi ci saasi sa original NS dokimaa.
2. 2ème étape: Diiru yewwute (redemptionPeriod, 30 fan):
   • Sudee kenn yeesalul domen bi ci diiru 1 (dafay faral di nekk ginaaw bis 30 ba 42, lépp di aju ci sàrti liggéey bi registrar bi tëral), registrar bi dafay efaase domen bi ci Registry bi, Registry bi daf koy dugal ci 30 fan yi war redemptionPeriod (fileek bindkat bi jaay domen bi jeex jaaraleko ci platform enkante domen bu jeex bu melni GoDaddy Auctions wala NameJet, xoolal bis bi 30 enkante bi sa bindkat bi def ci saasi).
   • Recovery: Mën nga ba leegi xettali domen bi ak 100 pursaa ci redemptionPeriod, ** jaaraleko ci Sekretëru Losing bi njëkk**. Danga wara jokkoo ak seen biro faktiir/ndimbal te nga fay Fee Restauration Registry Redemption (daanaka $80 ba $250 USD) boole ci yeesal 1 at.
3. Etape 3: Supprimer (pendingDelete, 5 fan yu mujj ci almanaak bi):
   • Benn yoon ci 30 fan yi redemptionPeriod buñu jeexee, domen bi dafay dugg pendingDelete ci diiru 5 fan (120 waxtu).
   • Njariñ: Ci diiru pendingDelete, Registry bi dafay bañ bépp EPP buñ miin restore komand yu bawoo ci registrar bi. Bu bis 5 jeexe (ngir .com/.net Verisign dafay wàcci, diggante 18:00 ak 19:15 UTC), domen bi dafay génn ci ñépp, ñu jël ko ci diir bu weesuwul 10 milisegond ci reso yuy jàpp wàcci otomatik.
   • Jëf ci jamp suñu jàppee pendingDelete wala enchère bi jeexal:
     • Sudee domen bi jaaynañu ko jaaraleko ci enchère bu 30 bisu registrar bi laata muy duggu ci Registry bi redemptionPeriod, xool ndax sa registrar dafay joxe palanteer bu gàtt ngir jëlaat enchère bi wala nga jokkool ak ki jël raw-gàddu gi/broker bi ci saasi.
     • Sudee domen bi mingi dëgg ci Bindu 5 fan yi pendingDelete fase, boole ci def backorders yu kawe ci ñetti reso yu mag yi (DropCatch.com, SnapNames.com, ak NameJet.com) suko defee sudee domen bi daanu ci piscine publik bi ci bis 5, sa backorder daf koy jàpp wala dugal la ci enchère bidder bi tëju ngir jëndaat sa domen.

Lan moo waral sama sitweb ba leegi du dox ay waxtu ginaaw bima yeesalee sama domen bu jeex? (Defar cache DNS bu baaxul)¶

Su sa domen jeexee, registrar bi dafay wecci sa NS dokimaa yu am serwëru gaaraas yu yam yiy faral di yóbbaale 24 waxtu ba 48 waxtu TTL (Waxtu-Dundu) (86400 wala 172800 segond). Doonte ginaaw boo fayyee faktiiru yeesal bi, sa registrar delloosi sa faktiiru dëgg NS dokimaa ci zone root ci diiru 5 simili, DNS recursif publik ci àdduna bi yépp (Google 8.8.8.8, Niir 1.1.1.1, Quad9 9.9.9.9, ak ISP resolvers) mën nañu wéy di liggéey ci xëtu gaaraas bi jeex ba TTL bu 48 waxtu bi jeex.

Ni ñuy forse ab DNS Global Flush ci saasi ci 60 seconde: Bul xaar 48 waxtu ngir cache recursif yi jeex ci seen bopp. Flush sa domen ci ñetti fournisseur DNS yi gëna mag ci àdduna bi leegi, jëfandikoo seen portaal cache-purge web bu amul fayda: 1. Flush Google DNS publik (8.8.8.8 / 8.8.4.4): Seeti developers.google.com/speed/public-dns/cache, xeetu yourdomain.com, tannal xeetu enregistrement NS (nga baamtu A, AAAA, MX, ak DS), nga bës Flush Cache. Loolu dafay fomp sa domen ci bépp santu done Google DNS ci àdduna bi ci diir bu néew 10 segond. 2. Flush DNS publik bu Cloudflare (1.1.1.1 / 1.0.0.1): Seeti one.one.one.one/purge-cache/, duggal yourdomain.com, tannal NS, A, AAAA, ak MX, nga bës Dindi Cache. 3. Flush OpenDNS / Parasol Cisco (208.67.222.222): Seeti cachecheck.opendns.com, duggal yourdomain.com, xoolal njariñ yi ci node global yi, nga bës Feesal Cache bi ci suufu tablo bi.

Faas 4: Defar DNSSEC bu yàqu (SERVFAIL) ginaaw ab migraasioŋ wala ab jàpp¶

Turu domen biy yokk kaaraange sistem bi (DNSSEC) dafay siñe say dokimaa DNS ci anam wu kriptografik (RRSIG dokimaa yuñ siñe ak caabi siñe zone ZSK ak Caabi Siñe Caabi KSK) ak siiwal lu méngoo Signeur Delegation (DS) hash ci zone TLD waajur ci sa registrar.

Bi DNSSEC di tere cache bi yàqu, tabb DNSSEC bu yàqu dafay indi ci saasi, ab dogg bu mat sëkk (SERVFAIL) ci bépp resolver buy saytu (bokk ci 8.8.8.8, 1.1.1.1, Comcast, ak porteurs yu mag yi). Loolu mooy gëna faral di am ci jamonoy toxu: ab administratër dafay toxu yourdomain.com's serwëru tur yi ci Cloudflare dem ci AWS Route 53 (wala luko moy) te doo njëkka efaase furnisër bu yàgg bi DS enregistre ci registreur domaine bi.

Saytu ak defar DNSSEC SERVFAIL tëjug ci 5 simili¶

1. Fàttaliku ni DNSSEC moo taañ: Daw ñaar dig komand yu toppalante: benn laajte bu jaadu, ak benn laajte ak +cd (Xam luñu deful) darapo, biy wax resolver recursif bi mu baña bayyi xel ci DNSSEC kriptografik validasioŋ:

   dig yourdomain.com @8.8.8.8
   dig yourdomain.com @8.8.8.8 +cd
   

   • Sudee komand bu njëkk bi jàllul ak status: SERVFAIL ak zero tontu, fekk ñaareelu komand (+cd) ci saasi mu am ndam ak status: NOERROR ak delloo sa A enregistre adres IP, 100 pursaa ci sa doggal DNSSEC chaine de confiance bu yàqu.
2. Xool bu baax ndax dafa yàqu DNSViz.net wala Verisign DNSSEC Debugger:
   • Ubbi dnsviz.net wala dnssec-debugger.verisignlabs.com nga dugg yourdomain.com.
   • Dina desine ab diagram buy wane ndax DS dokimaa yuñ siiwal ci sa registrar mënul méngoo ak DNSKEY sa host DNS bi fi nekk, wala sa siife zone (RRSIG) jeexnañu.
3. Saafara yu jamp:
   • Soo soppi fournisseur DNS: Duggal ci sa Registrar domaine, nga dem ci DNSSEC / DS Records, nga efaase li yàgg DS enregistrement (wala nga wecci ko ak bu bees bi DS enregistrement bi sa host DNS bu bees bi defar).
   • Flush DS cache enregistrement: Demal ci saasi ci Google DNS cache Flush (developers.google.com/speed/public-dns/cache) ak cache purge Cloudflare (one.one.one.one/purge-cache/) ak fomp DS ak DNSKEY xeetu dokimaa ngir yourdomain.com Kon baaxal resolver yi bàyyi xool liñu efaase DS hash ci saasi.

5ème étape: Raxas ginaaw defaraat, dindi sertifikaa TLS, ak dëgëral¶

Jox sa kontu registrar domen ak dokimaa DNS ci sa loxo genn-wàll xeex la. Ci waxtu yi wala bis yi songekat bi yor sa DNS domen, amoon nañu sañ-sañ bu mat sëkk ngir firndeel "Njëfandikoo Domen" (DCV) ci bépp kilifag sertifikaa (CA) ci kaw planet bi.

1. Sàrtifikaa Audit Leer Logs (crt.sh) ak dindi Sàrtifikaa TLS yu Rogue¶

Su ab songekat joxee sa A wala NS dokimaa ci seen serwër, ñu daal di daw ci saasi certbot (Nanu Encrypter, ZeroSSL, Serwiisu Google Trust, wala Sectigo) ngir sosal sertifikaa TLS yu baax, yu nawigatër bi wóolu ngir yourdomain.com, *.yourdomain.com, vpn.yourdomain.com, ak mail.yourdomain.com. Doonte defaraat nga say dokimaa DNS, ki lay song mingi wéy di yor Caabi bopp bi (.key) ak siñe Sàrtifikaa bu ñépp bokk (.crt) ngir sa domen, bi ñu mëna jëfandikoo ngir sos portaal Wi-Fi, jàpp BGP, wala nax reso bi ci biir ci 90 fan yii ci topp.

1. Laajte Sàrtifikaa Leer Logs:
   • Demal ci crt.sh/?q=%25.yourdomain.com wala Seetug Sàrtifikaa Censys (search.censys.io/certificates).
   • Tàngale ci Logged At / Not Before bis te xool bépp sertifikaa buñ joxe ci palanteer bi (ak ci 24 waxtu ginaaw biñu ko defaree, ndax ndigalu DCV yiñ denc).
2. Forse ñu dindi sertifikaa bi ci saasi:
   • Xamme ki joxe Ki yor Sertifikaa bi (Issuer Name) ci bépp sertifikaa buñu mayul ndigal.
   • Bépp CA bu ñépp wóolu dañu ko sàkku ci CA/Forum Navigateur Baseline Requirements (Section 4.9.1.1) mu dindi sertifikaa bu njuuj njaaj wala buñu mayul ndigal ci diiru 24 waxtu ginaaw bi ñu firndee ni boroom domen bi dëgguwul ki koy sàkku.
   • Sudee jot nga DNS ci domen bi, mën nga dindi sertifikaa yi Let's Encrypt wala ACME yi nga mayul ndigal ci diiru 60 seconde te soxlawoo caabi boppu ki lay song: dangay samp certbot ci serwër bi nga yor, nga joxe DNS-01 wala HTTP-01 bu bees ngir benn tur domen bi nga jëfandikoo caabi kontu ACME bu bees, nga daw:

     certbot revoke --cert-path downloaded_rogue_cert_from_crt_sh.pem --reason keycompromise
     

   • Wala nga yonne nimero seriiru sertifikaa bi ci portaalu dindi urgent bu CA (ci misaal, xëtu tegtali dindi bu Let's Encrypt, DigiCert's /revoke portaal, wala formileeru rapoor ci SSL bu Sectigo).

2. Tëj sa domen ba fàww suko defee ñu baña jàppaat ko¶

Gunaaw buñu delloosi liggéey yi, defal juróomi doxalin yii di dëgëral domen bi:

1. Aktiwise tëjug Registre (serverUpdateProhibited, serverDeleteProhibited, serverTransferProhibited):
   • Ngir domen yi gëna am solo ci liggéey bi, yeesal ba ci registrar buy joxe Registry Lock dëgg (Verisign moo ko jàppale ci .com/.net, PIR ci kaw .org, te ñu koy joxe jaaraleko ci bindkati liggéeyukaay yu melni MarkMonitor, sarwiisu màrku numérik CSC, liggéeyukaay Cloudflare, Porkbun / Gandi / Namecheap Bindu Lock tiers). Ak Registry Lock biy dox, doonte pirat bi sàcc na sa dugg ci registrar bi ak MFA, TLD Registry bi dafay bañ lépp NS wala toxal coppite fileek ofisiye kaaraange nit deful ab xew-xewu kriptograafi/telefoŋ bu nekk ci biti.
2. Siiwal CAA (Njàngalem kilifag sertifikaasioŋ) Done DNS:
   • Yokk CAA enregistrement (RFC 8659) ci sa zone DNS di leeral njiitu sàrtifikaa yi ñu may ñu joxe sàrtifikaa TLS ngir sa domen (ci misaal, 0 issue "letsencrypt.org" wala 0 issue "digicert.com", yokk 0 iodef "mailto:security@yourdomain.com"). Bi nga xamee ni ab songekat bu yor sa zone DNS bi yépp mënna efaase ab CAA enregistrement, a CAA enregistrement bi dafay tere BGP hijackers yi wala subdomain CNAME yiñ jëfandikoo CA yuñu mayul ndigal.
3. Tàqale sa Registrar Domain ak sa Fournisseur DNS bu bis bu nekk:
   • Fexeel tëj sa domen ci biir benn kontu registrar bu am kaaraange gu mat sëkk, 2 ofisiye liggéeyukaay kese ñoo ko mëna jëfandikoo FIDO2 caabi kaaraange hardware (YubiKey), nga jox bis bu nekk njiitu dokimaa DNS (A, CNAME, TXT) ci benn sarwis DNS buñ yor bu wuute ak Kontrolu Accès bu sukkandiko ci Rol (RBAC) ak ay token API yuñ yamale.
4. ** Xool te dindi subdomaine buy tëdd CNAME ak NS Done**:
   • Doxal ab scanner otomatik weer wu nekk ci sa fichier zone DNS bi yépp (subzy, nuclei -t takeovers/, wala OWASP Amass) ngir xàmmee bépp CNAME, ALIAS, wala domen bu ndaw NS enregistrement buy wane ab resourse cloud bu biti buñu bindul wala domen bu jeex, nga efaase enregistrement DNS bi balaa di dindi serwëru cloud bi.
5. Defar RDAP, DNS, ak CT Log buy saytu:
   • Taxawal ab monitër bu biti (lu melni CertSpotter, Cloudflare Sàrtifikaa biy saytu leer gi, wala saytu skript cron bu yomb waxtu wu nekk dig NS ak whois) di artu chaine Slack/PagerDuty buñ jagleel ak adres SMS/email bu nekk ci bitti domen bi ci simili bi sertifikaa TLS bu bees dugg ci Sàrtifikaa Leer wala NS/MX/DS enregistre coppite yi.

Laaj yi ñuy faral di laaj¶

Saytu nañu ay balluwaay¶

• Kaaraange siber ak kuréel gi yor kaaraange ci jumtukaay yi (CISA, Etats Unis): Njàngale mu jamp 19-01: Wàññi jafe-jafe yi ci jumtukaayi DNS (CISA dafa santaane tëjug Registre, MFA ngir DNS/Bindkat yi, Xool sertifikaa yu leer, ak DNSSEC validation ()cisa.gov/news-events/directives/emergency-directive-19-01).
• Sosiete internet ngir tur ak nimero yiñ jox (ICANN, internasional): Politig joxe (Politig joxe ci diggante bindkat yi / IRTP), Politig saafara jafe-jafe ci joxe (TDRP), Politig joxewaat bind bu jeex (ERRP), ak *Codesfericann.org/resources/pages/epp-status-codes-2014-06-16-en).
• Daara bu kawe biy saytu ni ñuy doxalee ak xarala yu bees yi (NIST, Etats Unis): Publikasioŋ buñ jagleel 800-81-2, Gidu jëfandikoo sistemu tur domen bu wóor (DNS) (csrc.nist.gov).
• Santar bu Kaaraange Siber bu Réew mi (NCSC, Royaume-Uni): Aar Done yu bari ak Kaaraange Domen: Tëjug Registre, Done CAA, ak Faggu ñu jël domen bu ndaw (ncsc.gov.uk).
• CA/Forum Navigateur (International): Li ñuy laaj ngir joxe ak yoriinu Sertifikaayu Serveur TLS bu ñépp wóolu (Wàll 4.9.1.1: 24 waxtu yuñ wara dindi ngir domen bi) (cabforum.org).
• Kuréel giy liggéey ci wàllu Ingénieur ci Internet (IETF, ci àdduna): RFC 4033/4034/4035 (DNSSEC), RFC 8659 (DNS Sertifikaasioŋ Otorite / CAA Record Resource), ak RFC 9083 (Protokolu jëfandikoo ay done ci bindu / RDAP) (datatracker.ietf.org).

Gid yu jëm ci loolu¶

• Jafe-jafe dalal web, dem ak dikk, ak defaraat backup
• Phishing ak kontu yuñ laal
• MFA phishing ak noon-ci-digg bi
• Tontu ci wàllu done ak sacc baatu-jàll
• Ransomware liggéeyukaay ak yàqu-yàqu serwër
• weccoo SIM