Phoenix Domain Attack: Vulnerable Links in Domain Name Delegation and Revocation

Phoenix Domain is a general and novel attack that allows adversaries to maintain the revoked malicious domain continuously resolvable at scale, which enables an old, mitigated attack, Ghost Domain. Phoenix Domain has two variations and affects all mainstream DNS software and public DNS resolvers overall because it does not violate any DNS specifications and best security practices.

The attack is made possible through systematically "reverse engineering" the cache operations of 8 DNS implementations, and new attack surfaces are revealed in …

adversaries attack dns domain domain name general ghost links malicious name novel old phoenix public scale software vulnerable