Security defense method and system for waste domain name hijacking, terminal and storage medium

Abstract

The invention discloses a security defense method and system for discarded domain name hijacking, a terminal and a storage medium, and the method comprises the steps: determining a target secondary domain, and carrying out the sub-domain name creation processing and IP address configuration processing of the target secondary domain, and obtaining a target IP address; determining a waste sub-domain name, and performing record deletion processing and domain name record addition processing on the waste sub-domain name to obtain a domain name alias record; extracting a target IP address according to an access request and the domain name alias record when the access request of the user terminal equipment to the abandoned sub-domain name is received; and sending the target IP address to the user terminal equipment, and entering a target website page according to the target IP address. According to the method and the device, a weekly known sub-domain name and a domain name alias record are newly added, so that a user can access a target IP address controlled by a service party under the condition that a related URL link is retained after the abandoned sub-domain name is deleted, and the hijacking risk of the abandoned domain name remaining link is effectively defended.

Description

A security defense method, system, terminal, and storage medium for hijacking abandoned domain names. Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a security defense method, system, terminal, and computer-readable storage medium for hijacking abandoned domain names. Background Technology

[0002] When users access internet services on their devices, they generally need to perform domain name resolution (for example, resolving xx.cn to the corresponding IP address) to obtain the IP address of the website before they can successfully access it.

[0003] However, even if some abandoned domain names (such as xxx.xx.cn, which is a subdomain of xx.cn) are deleted from their respective second-level domain authoritative servers (i.e., the authoritative server of xx.cn), if the relevant URL links for accessing abandoned domain names are still retained on other accessible pages (such as xx.cn, etc.), users may still be mistakenly redirected to the advertising pages of the recursive server, thus leading to the leakage of users' privacy data.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] The main objective of this invention is to provide a security defense method, system, terminal, and computer-readable storage medium for hijacking abandoned domain names. It aims to solve the problem in the prior art where, after some abandoned domain names are deleted from their respective authoritative secondary domain name servers, if other accessible pages still retain the URL links related to accessing the abandoned domain names, users may be mistakenly redirected to advertising pages on recursive servers, leading to the leakage of user privacy data.

[0006] To achieve the above objectives, this invention provides a security defense method for preventing hijacking of abandoned domain names. The method includes the following steps: identifying a target secondary domain, and performing subdomain creation and IP address configuration processing on the target secondary domain to obtain a target IP address; identifying abandoned subdomains within the target secondary domain, and performing record deletion and domain name record addition processing on the abandoned subdomains to obtain domain alias records; when receiving an access request from a user terminal device for the abandoned subdomain, extracting the target IP address based on the access request and the domain alias record; sending the target IP address to the user terminal device, and accessing the target website page based on the target IP address.

[0007] Optionally, the security defense method against abandoned domain name hijacking, wherein determining the target secondary domain and performing subdomain creation and IP address configuration processing on the target secondary domain to obtain the target IP address specifically includes: determining the target secondary domain and determining the authoritative server corresponding to the target secondary domain; performing subdomain creation processing on the target secondary domain authoritative server to obtain a well-known subdomain; and performing IP address configuration processing on the well-known subdomain on the authoritative server to obtain the target IP address.

[0008] Optionally, the security defense method against abandoned domain name hijacking, wherein the step of configuring the IP address of the well-known subdomain in the authoritative server of the secondary domain to obtain the target IP address specifically includes: determining a preset IPv4 address record or a preset IPv6 address record, and obtaining the authoritative server configuration file in the authoritative server of the secondary domain; searching for the configuration information of the well-known subdomain in the authoritative server configuration file, and when the configuration information in the authoritative server configuration file is found, adding the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

[0009] Optionally, in the aforementioned security defense method against abandoned domain name hijacking, the target IP address is either the configuration information of the well-known subdomain plus the preset IPv4 address record, or the configuration information of the well-known subdomain plus the preset IPv6 address record.

[0010] Optionally, the security defense method for hijacking abandoned domain names, wherein determining the abandoned subdomains in the target second-level domain and performing record deletion and domain name record addition processing on the abandoned subdomains to obtain domain name alias records specifically includes: determining the abandoned subdomains in the target second-level domain that need to be abandoned, searching for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; deleting records of the abandoned subdomain information, and adding domain name records in the authoritative server of the second-level domain based on the abandoned subdomains and the well-known subdomains to obtain domain name alias records.

[0011] Optionally, the security defense method against abandoned domain name hijacking, wherein when a user terminal device receives an access request for the abandoned subdomain, extracting the target IP address based on the access request and the domain name alias record, specifically includes: when a user terminal device receives an access request for the abandoned subdomain, determining a recursive server and sending the access request and the domain name alias record to the recursive server; the recursive server then sends the access request and the domain name alias record to the secondary domain authority server, and the secondary domain authority server extracts the target IP address based on the access request and the domain name alias record.

[0012] Optionally, the security defense method against hijacking of abandoned domain names further includes, before the step of extracting the target IP address based on the access request and the domain name alias record when a user terminal device receives an access request for the abandoned subdomain, the method further includes: when the user terminal device accesses the main website webpage based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain name alias record.

[0013] Optionally, the security defense method against abandoned domain name hijacking further includes, when the user terminal device accesses the main website webpage based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record, and then further including: if the main website webpage has a related URL link corresponding to the abandoned subdomain, then receiving the access request from the user terminal device for the abandoned subdomain.

[0014] Optionally, the security defense method against abandoned domain name hijacking further includes the following steps: when the user terminal device accesses the main website webpage based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record; if the main website webpage does not have a related URL link corresponding to the abandoned subdomain, then returning a domain name non-existent result to the user terminal device.

[0015] Optionally, the security defense method against abandoned domain name hijacking, wherein sending the target IP address to the user terminal device and accessing the target website page according to the target IP address specifically includes: sending the target IP address to the recursive server through the secondary domain authority server, and the recursive server sending the target IP address to the user terminal device; the user terminal device accessing the webpage according to the target IP address and entering the target website page corresponding to the target IP address.

[0016] Furthermore, to achieve the above objectives, the present invention also provides a security defense system for hijacking abandoned domain names. This system includes: a target IP address generation module, used to determine a target secondary domain and perform subdomain creation and IP address configuration processing on the target secondary domain to obtain a target IP address; a domain alias record generation module, used to determine abandoned subdomains in the target secondary domain and perform record deletion and domain record addition processing on the abandoned subdomains to obtain domain alias records; an abandoned subdomain access module, used to extract the target IP address based on the access request and the domain alias record when an access request for the abandoned subdomain is received from a user terminal device; and a target IP address access module, used to send the target IP address to the user terminal device and access the target website page based on the target IP address.

[0017] Optionally, in the aforementioned security defense system against abandoned domain name hijacking, the target IP address generation module includes: a target secondary domain determination unit, used to determine the target secondary domain and the corresponding authoritative server for the secondary domain; a subdomain creation processing unit, used to perform subdomain creation processing on the target secondary domain in the authoritative server to obtain a well-known subdomain; and an IP address configuration unit, used to perform IP address configuration processing on the well-known subdomain in the authoritative server to obtain a target IP address.

[0018] Optionally, in the aforementioned security defense system against abandoned domain name hijacking, the IP address configuration unit includes: a configuration file acquisition subunit, used to determine a preset IPv4 address record or a preset IPv6 address record, and acquire the authoritative server configuration file in the secondary domain authoritative server; and a configuration information addition subunit, used to search for the configuration information of the well-known subdomain in the authoritative server configuration file, and when the configuration information in the authoritative server configuration file is found, to add the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

[0019] Optionally, in the aforementioned security defense system against abandoned domain name hijacking, the domain name alias record generation module includes: an abandoned subdomain lookup unit, used to determine the abandoned subdomains that need to be abandoned in the target second-level domain, and to search for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; and a domain name record addition unit, used to delete records of the abandoned subdomain information, and to add domain name records in the second-level domain authoritative server based on the abandoned subdomains and the well-known subdomains to obtain domain name alias records.

[0020] Optionally, in the aforementioned security defense system against hijacking of abandoned domain names, the abandoned subdomain access module includes: an access request receiving unit, configured to determine a recursive server when receiving an access request from a user terminal device for the abandoned subdomain, and send the access request and the domain name alias record to the recursive server; and a target IP address extraction unit, configured to send the access request and the domain name alias record to the secondary domain authority server through the recursive server, wherein the secondary domain authority server extracts the target IP address based on the access request and the domain name alias record.

[0021] Optionally, in the aforementioned security defense system against hijacking of abandoned domain names, the abandoned subdomain access module further includes: a related URL link judgment unit, used to determine whether the main site webpage has a related URL link corresponding to the abandoned subdomain when the user terminal device accesses the main site webpage based on the abandoned subdomain, according to the domain alias record.

[0022] Optionally, in the aforementioned security defense system against hijacking of abandoned domain names, the abandoned subdomain access module further includes: an access request receiving unit, used to receive an access request from the user terminal device for the abandoned subdomain if the main website webpage has a relevant URL link corresponding to the abandoned subdomain.

[0023] Optionally, in the aforementioned security defense system against abandoned domain name hijacking, the target IP address access module includes: a target IP address sending unit, used to send the target IP address to the recursive server through the secondary domain authority server, and the recursive server to send the target IP address to the user terminal device; and a target website page entry unit, used by the user terminal device to access a webpage based on the target IP address and enter the target website page corresponding to the target IP address.

[0024] In addition, to achieve the above objectives, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a security defense program for abandoned domain name hijacking stored in the memory and executable on the processor, wherein when the security defense program for abandoned domain name hijacking is executed by the processor, it implements the steps of the security defense method for abandoned domain name hijacking as described above.

[0025] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a security defense program for abandoned domain name hijacking, and when the security defense program for abandoned domain name hijacking is executed by a processor, it implements the steps of the security defense method for abandoned domain name hijacking as described above.

[0026] In this invention, a target second-level domain is identified, and subdomain creation and IP address configuration are performed on the target second-level domain to obtain a target IP address. Deprecated subdomains within the target second-level domain are identified, and record deletion and domain name record addition are performed on the deprecated subdomains to obtain domain alias records. When an access request for the deprecated subdomain is received from a user terminal device, the target IP address is extracted based on the access request and the domain alias record. The target IP address is sent to the user terminal device, and the user is directed to the target website page based on the target IP address. By adding a well-known subdomain and domain alias record, this invention ensures that even after the deletion of a deprecated subdomain, the user can still access the target IP address controlled by the business party, effectively preventing the hijacking risk of residual links from deprecated domains. Attached Figure Description

[0027] Figure 1 is a schematic diagram of the overall process of directly deleting abandoned domain names in the prior art; Figure 2 is a schematic diagram of the overall process of configuring wildcard domains and deleting abandoned domain names in the prior art; Figure 3 is a flowchart of a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 4 is an overall flowchart of a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 5 is a flowchart of the specific implementation process of step S10 in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 6 is a flowchart of the specific implementation process of step S13 in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 7 is a flowchart of the specific implementation process of step S20 in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 8 is a flowchart of the specific implementation process of step S30 in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention. Figure 9 is a flowchart of the specific implementation process of step S40 in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 10 is a flowchart of the judgment of the relevant URL link corresponding to the abandoned subdomain in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 11 is a flowchart of the determination of the relevant URL link corresponding to the abandoned subdomain in the main site webpage in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 12 is a flowchart of the determination of the relevant URL link corresponding to the abandoned subdomain in the main site webpage in a preferred embodiment of the security defense method for abandoned domain name hijacking of the present invention; Figure 13 is a structural schematic diagram of the security defense system for abandoned domain name hijacking of the present invention; Figure 14 is another structural schematic diagram of the security defense system for abandoned domain name hijacking of the present invention; Figure 15 is a structural diagram of a preferred embodiment of the terminal of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0029] To facilitate understanding of the technical content involved in this invention, the following terms are first explained: Device refers to user terminal equipment, such as PC, mobile phone, tablet, etc.; RootServer refers to root authoritative server, such as the authoritative server of the root "."; TLDServer refers to top-level domain authoritative server, such as the authoritative server of .com, .cn, etc.; SLDServer refers to second-level domain authoritative server, such as the authoritative server of google.com, qq.com, weibo.cn, etc.; RecurDNS refers to recursive server, such as China Telecom DNS, China Unicom DNS, 114DNS, etc.; RR refers to DNS resource record; NS refers to name server record, also known as NS RR; A refers to IPv4 address record, also known as ARR; AAAA refers to IPv6 address record, also known as AAAA RR; CNAME refers to domain alias record, also known as CNAME RR.

[0030] When users access internet services on their devices, they generally need to resolve the domain name (for example, resolving weibo.cn to the corresponding IP address) to obtain the IP address of the website before they can successfully access it.

[0031] However, even if some abandoned domain names (such as xxx.weibo.cn) are removed from their respective authoritative subdomain servers (e.g., the authoritative server of weibo.cn), users may still be misdirected to advertising pages on recursive servers (i.e., RecurDNS) if the corresponding URLs for accessing abandoned domain names remain on other accessible pages (e.g., weibo.cn). This could lead to the leakage of user cookies, resulting in the leakage of user privacy data and malicious manipulation of user accounts to follow certain celebrity accounts. For example, frequently popping up inexplicable ads may indicate that the router or ISP has hijacked the connection.

[0032] Therefore, it is necessary to design security defense methods against abandoned domain name hijacking in order to prevent the aforementioned domain name hijacking attacks.

[0033] To address the aforementioned issues, existing technologies employ the following two solutions: As shown in Figure 1, Solution A involves "directly deleting abandoned domain names," with the specific implementation process as follows: 1. Assume the second-level domain is example.cn; 2. When the business decides to abandon a domain name xxx.example.cn (i.e., an abandoned subdomain) under example.cn, all records for xxx.example.cn are directly deleted from the second-level domain authority server (SLDServer) of example.cn; 3. Subsequently, the user terminal device queries the RecurDNS (i.e., the recursive server) for the IP address of xxx.example.cn; 4. When the RecurDNS (i.e., the recursive server) queries the IP address of xxx.example.cn, the SLDServer (second-level domain authority server) will return NXDOMAIN (i.e., display no domain name), indicating that the domain name does not exist.

[0034] An honest RecurDNS server will return NXDOMIN to the Device, while a hijacked RecurDNS server will return a pre-constructed IP address (denoted as HijackIP, for example, the IP address corresponding to the advertising page server) of another server (such as an ad page server) operated by the RecurDNS.

[0035] In other words, in Scheme A, when a deprecated domain name is deleted, and a request is made again on another website, normally the result of "no corresponding domain name" (i.e., NXDOMIN, showing no domain name) should be received. However, if the recursive server intercepts the request, it will send pre-built advertisements to the device, causing the user to see advertising information.

[0036] Understandably, Scenario A describes a typical scenario where DNS resolution differences may occur after a domain name is abandoned. It includes a normal process (honest resolution) and a hijacking process (dishonest resolution). The specific comparison of the two processes is as follows: Normal Process (Honest Resolution): 1. Decision and Operation: The business decides to abandon the subdomain xxx.example.cn under the second-level domain example.cn. The administrator then deletes all DNS records for the subdomain xxx.example.cn on its authoritative DNS server (SLD Server); 2. User Initiation of Query: When a user's device attempts to access xxx.example.cn, a query request is initiated to the locally configured recursive DNS server.

[0037] 3. Recursive query and authoritative response: When a recursive DNS server resolves xxx.example.cn, it will query the authoritative chain of example.cn. If the authoritative server confirms that xxx.example.cn no longer exists, it will return the NXDOMAIN response code, explicitly stating "this domain name does not exist".

[0038] 4. Feedback: An honest recursive DNS server returns the result of this NXDOMAIN response code to the user's terminal device as is. The user's browser or application will usually display "Server not found" or a similar error.

[0039] Hijacking process (dishonest resolution): 1. The first 3 steps are the same as the normal process. The key is the 4th step: When the recursive DNS server receives the NXDOMAIN returned by the authoritative server, some unruly operators (i.e., recursive servers) may choose to intercept and tamper with this response. They will not inform the user that the domain name does not exist, but will return an IP address pre-set by the operator (such as an advertising IP address).

[0040] 2. Hijacking result: The user's device receives a fake DNS resolution result (HijackIP). This IP usually points to the operator's advertising push page, navigation site, or search page. As a result, the user cannot know the truth that the domain name has been abandoned, and is instead redirected to an irrelevant website.

[0041] The above scenario reveals a key issue in internet infrastructure: the trustworthiness of recursive DNS servers, which directly determines the user experience and security when accessing obsolete domain names.

[0042] The different impacts of the two results are as follows: 1. Returning NXDOMAIN (honest behavior): This is the correct behavior in accordance with the protocol specifications. It clearly conveys the message that "the resource no longer exists", allowing users and devices to take appropriate measures (such as checking the spelling of the URL or finding alternative services). This is a respect for the user's right to know.

[0043] 2. HijackIP return (hijacking behavior): This is a typical DNS hijacking that brings many negative impacts, including: a) disrupting user experience, where users intend to access A but are forcibly redirected to B, and the process is abruptly interrupted.

[0044] b. Damage to brand reputation: The domain holder may want to clearly convey that the business has been shut down, but hijacking causes confusion and makes users mistakenly believe that the original service has become an advertising site, which damages the brand image.

[0045] c. Security risks: The hijacked page may contain malicious advertisements or phishing links, posing security risks.

[0046] d. Distorting network data: This hijacking behavior contaminates normal network statistics and monitoring data.

[0047] This situation can occur because, in the standard DNS query chain, recursive DNS servers act as "middlemen," and end users rely entirely on their honesty to return authoritative answers. Some unethical operators exploit this trust to monetize DNS resolution traffic.

[0048] As shown in Figure 2, Scheme B uses a wildcard domain configuration and deletes obsolete domains. The specific process is as follows: 1. Assume the second-level domain is example.cn; 2. The service configures the IP address (denoted as WildIP) of the wildcard domain *.example.cn for example.cn; 3. When the service decides to obsolete a domain xxx.example.cn (i.e., an obsolete subdomain) under example.cn, it directly deletes all records of xxx.example.cn from the second-level domain authority server (SLDServer) of example.cn; 4. Subsequently, the user terminal device (Device) queries the RecurDNS (i.e., the recursive server) for the IP address of xxx.example.cn; 5. The RecurDNS queries the IP address of xxx.example.cn, and the SLDServer (second-level domain authority server) will return the WildIP previously configured for the wildcard domain *.example.cn; 6. The RecurDNS will return the WildIP to the Device.

[0049] Compared to the existing Solution A, Solution B first sets up a wildcard domain name for the corresponding second-level domain. When a user accesses this abandoned domain name, they will be redirected to the IP address corresponding to this wildcard domain name.

[0050] In summary, the disadvantages of the existing technical solutions are as follows: 1. Solution A cannot defend against hijacking of NXDOMAIN by the recursive server (RecurDNS). When RecurDNS receives the response of NXDOMAIN from SLDServer, RecurDNS can still return HijackIP (e.g., an advertising page).

[0051] 2. While Solution B can defend against HijackIPs returned by the RecurDNS server, it is ineffective against DDoS attacks involving random subdomains. Hackers can control a massive number of devices to query RecurDNS for random subdomains (e.g., abcxxx.example.cn, bcdxxx.example.cn, xxxxx.example.cn, yyyyy.example.cn, etc.). RecurDNS forwards the query to the SLDServer, but if these random subdomains do not exist on the SLDServer, it returns a WildIP, which RecurDNS then forwards to the devices. However, when a massive number of devices query a large number of random subdomains, the increasing volume of domain queries received by the SLDServer leads to a continuous increase in the number of random subdomains cached by RecurDNS, potentially causing both RecurDNS and the SLDServer to crash.

[0052] The preferred embodiment of the present invention describes a security defense method for hijacking abandoned domain names, as shown in Figures 3 and 4. The security defense method for hijacking abandoned domain names includes the following steps: Step S10: Determine the target secondary domain, and perform subdomain creation processing and IP address configuration processing on the target secondary domain to obtain the target IP address.

[0053] Among them, abandoned subdomains refer to subdomains that an organization (such as a company or school) once used but later stopped renewing or maintaining and were eventually deleted, such as old-portal.example.com and promo-2020.example.com. These domains are usually forgotten in the history records.

[0054] The risks arise from: 1. Domain release: When the subdomain is no longer renewed, the domain registrar will eventually remove it from the domain name system, making it "registerable" again.

[0055] 2. Attackers' domain name hijacking: Cyber ​​attackers continuously monitor the expiration status of well-known companies' domain names and quickly register these abandoned subdomains. This process is known as "subdomain hijacking" or "domain name squatting".

[0056] The harms of hijacking (generally referring to hijacking of recursive servers) are as follows: 1. Phishing attack: Attackers can build a page on the registered domain that is extremely similar to the original official website to steal user credentials, bank card information, etc.

[0057] 2. Malware distribution: Using the domain name for hosting and spreading viruses and Trojans.

[0058] 3. Damage to reputation: Brand domain names may be used for illegal activities, seriously damaging the company's reputation.

[0059] 4. SSL certificate abuse: Attackers may apply for an SSL certificate for the domain (because the domain ownership has been transferred), making the malicious website appear as a "secure" HTTPS connection, which is more deceptive.

[0060] Specifically, the goal of this invention is to construct a well-known subdomain that, when an abandoned subdomain is deleted and accessed by other platform websites, redirects to the target IP address corresponding to the well-known subdomain, thereby preventing hijacking by recursive servers.

[0061] As shown in Figure 5, step S10 specifically includes: step S11, determining the target secondary domain and determining the secondary domain authority server corresponding to the target secondary domain.

[0062] Specifically, step S11 is implemented as follows: Assuming the second-level domain is example.cn, if a subdomain needs to be created for example.cn, the authoritative server of the second-level domain corresponding to the target second-level domain needs to be found first. Then, the subdomain can be created through the authoritative server of the second-level domain.

[0063] Step S12: In the authoritative server of the second-level domain, perform subdomain creation processing on the target second-level domain to obtain the well-known subdomain.

[0064] Specifically, step S12 is implemented as follows: the business creates a well-known subdomain (i.e., the well-known subdomain in this invention) through the second-level domain authority server, with the expression: _abandon.example.cn.

[0065] The specific process for creating a new subdomain is as follows: Creating a new subdomain (i.e., a well-known subdomain, such as _abandon.example.cn) from a second-level domain (example.cn) is an operation that follows international standards. The main operation is to add a record in the authoritative server provider of example.cn, thereby obtaining the well-known subdomain corresponding to the target second-level domain.

[0066] The purpose of the well-known subdomain set in this invention is as follows: _abandon.example.cn (i.e., the well-known subdomain in this invention) is used to provide default resolution for abandoned domain names. For example, after somexxx.example.cn is abandoned, this invention will point to _abandon.example.cn through CNAME (i.e., domain alias record).

[0067] Step S13: Configure the IP address of the well-known subdomain in the second-level domain authority server to obtain the target IP address.

[0068] Specifically, step S13 is implemented as follows: the IP address configured for the business is _abandon.example.cn (i.e., the well-known subdomain), denoted as AbandonIP.

[0069] The configuration process is as follows: following international standard procedures, add a new record in the second-level domain authority server of example.cn.

[0070] For example, if the IP address of _abandon.example.cn (i.e., the well-known subdomain) is configured as 202.38.64.10, then a new record needs to be added to the "authoritative server configuration file of example.cn": _abandon.example.cnA202.38.64.10, and "_abandon.example.cnA202.38.64.10" is the target IP address of this invention.

[0071] As shown in Figure 6, step S13 specifically includes: step S131, determining a preset IPv4 address record or a preset IPv6 address record, and obtaining the authoritative server configuration file in the secondary domain authoritative server.

[0072] Specifically, step S131 is implemented as follows: After constructing the well-known subdomain _abandon.example.cn, the present invention needs to configure a corresponding IP address for the well-known subdomain _abandon.example.cn, and this IP address needs to be processed in the authoritative server configuration file in the second-level domain authoritative server of example.cn.

[0073] Step S132: Search for the configuration information of the well-known subdomain in the authoritative server configuration file. When the configuration information in the authoritative server configuration file is found, add the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

[0074] The target IP address is either the configuration information of the well-known subdomain plus the preset IPv4 address record, or the configuration information of the well-known subdomain plus the preset IPv6 address record.

[0075] Specifically, step S132 is implemented as follows: For the construction of the target IP address, after determining the authoritative server configuration file in the authoritative server of the second-level domain corresponding to the known subdomain, the present invention will search in the authoritative server configuration file according to the information corresponding to the known subdomain. After finding and modifying the configuration information corresponding to the known subdomain, a preset IPv4 address record or a preset IPv6 address will be added to the configuration information corresponding to the known subdomain, such as A202.38.64.10. After the addition is completed, the target IP address can be obtained, with the expression: _abandon.example.cnA202.38.64.10.

[0076] In other words, the core idea behind constructing a target IP address is to fully utilize known subdomain information and achieve efficient generation of the target IP address through precise manipulation of the authoritative server configuration file. Specifically, when constructing a target IP address, the first step is to determine the authoritative server for the second-level domain corresponding to the well-known subdomain. Here, "well-known subdomains" refer to subdomains that are widely recognized and used in a specific network environment. They are typically closely related to specific network services or business applications, and their corresponding authoritative servers store key configuration information related to that subdomain.

[0077] After identifying the authoritative server for the second-level domain corresponding to the well-known subdomain, this invention delves further into the configuration file of that authoritative server. The authoritative server configuration file is a crucial file storing the mapping relationship between domain names and IP addresses, as well as other relevant parameters, and it plays a decisive role in the domain name resolution process. Based on the information corresponding to the well-known subdomain, this invention performs a precise search within the authoritative server configuration file to find configuration information related to that subdomain. This search process is based on a series of preset rules and algorithms, enabling rapid location of configuration items matching the well-known subdomain, thus laying the foundation for subsequent IP address construction.

[0078] Once the configuration information corresponding to the well-known subdomain is found in the authoritative server configuration file, this invention modifies it. This modification is not arbitrary but based on specific business needs and network planning, aiming to better adapt the subdomain to new network environments or business scenarios. After modification, this invention adds a preset IPv4 address record or a preset IPv6 address to the configuration information corresponding to the well-known subdomain. For example, the added IPv4 address could be "202.38.64.10". This added IP address is carefully selected and planned to meet the specific business's access requirements for network resources and has good reachability and stability within the network architecture.

[0079] To illustrate this process, let's take a concrete example: Following the method of this invention, after determining the authoritative server for the second-level domain corresponding to "_abandon.example.cn", we access its authoritative server configuration file and find the configuration information related to that subdomain. Then, we modify this configuration information, adding a new IPv4 address record "A202.38.64.10". This completes the construction of the target IP address, resulting in the expression "_abandon.example.cn A 202.38.64.10". In this way, the previously abandoned subdomain is given new life, quickly and accurately pointing to a new network service, achieving effective integration and reuse of network resources.

[0080] Step S20: Determine the abandoned subdomains in the target second-level domain, and perform record deletion and domain name record addition processing on the abandoned subdomains to obtain domain name alias records.

[0081] Specifically, when it is necessary to delete abandoned subdomains, in addition to deleting all information of abandoned subdomains in the authoritative server configuration file, this invention will also construct domain alias records based on abandoned subdomains and well-known subdomains that have been created. The significance of constructing domain alias records is that when user terminal devices subsequently log in to abandoned subdomains on other platform websites, the domain alias records will point to the target IP address corresponding to the well-known subdomains, thereby directly redirecting to the target IP address to prevent hijacking by recursive servers.

[0082] As shown in Figure 7, step S20 specifically includes: step S21, determining the abandoned subdomains that need to be abandoned in the target second-level domain, and searching and processing all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information.

[0083] Specifically, step S21 is implemented as follows: When the business decides to abandon a domain name xxx.example.cn (i.e., an abandoned subdomain) under example.cn (i.e., the target second-level domain), all existing records of xxx.example.cn are first deleted directly from the authoritative server (SLDServer) of the second-level domain corresponding to example.cn (for example, to delete somexxx.example.cn, all entries containing somexxx.example.cn need to be deleted from the "authoritative server configuration file of example.cn"). Then, a new CNAME record (i.e., the domain alias record in this invention) is added, with the expression: xxx.example.cnCNAME_abandon.example.cn. It can be seen that the CNAME record establishes a pointing relationship between xxx.example.cn and the well-known subdomain. That is, when the user's terminal device subsequently logs in to the abandoned subdomain on other platform websites, the domain alias record will point to the target IP address corresponding to the well-known subdomain.

[0084] Step S22: Delete the records of the abandoned subdomain information, and add domain name records in the second-level domain authority server based on the abandoned subdomain and the well-known subdomain to obtain domain name alias records.

[0085] Specifically, step S22 is implemented as follows: The configuration process for the CNAME record (i.e., the domain alias record in this invention) is as follows: For example, to configure the CNAME of somexxx.example.cn to _abandon.example.cn, a new record needs to be added in the "authoritative server configuration file of example.cn": somexxx.example.cnCNAME_abandon.example.cn.

[0086] The effect of creating a CNAME record is to enable xxx.example.cn to resolve to the IP address of _abandon.example.cn, and at the same time, to make it less likely for users to be hijacked when accessing the xxx.example.cn / somepage link left on the yyy.example.cn webpage.

[0087] Step S30: When a user terminal device receives an access request for the abandoned subdomain, the target IP address is extracted based on the access request and the domain alias record.

[0088] Specifically, when a user terminal device accesses the abandoned subdomain on another platform website, and that platform website retains the relevant URL link corresponding to the abandoned subdomain, the second-level domain authority server will directly point to the target IP address through the domain alias record when obtaining the IP address, and then send the target IP address back to the user terminal device through the recursive server.

[0089] As shown in Figure 8, step S30 specifically includes: step S31, when a user terminal device receives an access request for the abandoned subdomain, a recursive server is determined, and the access request and the domain name alias record are sent to the recursive server.

[0090] Specifically, step S31 is implemented as follows: when a user terminal accesses an abandoned subdomain, the user terminal device (Device) first queries the RecurDNS (recursive server) for the IP address of xxx.example.cn (i.e., the abandoned subdomain). At the same time, it also records the domain name alias record that has been configured in advance in this invention. The domain name alias record can help the secondary domain authority server to point to the IP address in the future.

[0091] Step S32: The access request and the domain name alias record are sent to the secondary domain authority server through the recursive server. The secondary domain authority server extracts the target IP address based on the access request and the domain name alias record.

[0092] Specifically, step S32 is implemented as follows: RecurDNS (recursive server) queries the IP address of xxx.example.cn (abandoned subdomain), and SLDServer (second-level domain authority server) returns the AbandonIP (target IP address) previously configured for _abandon.example.cn (well-known subdomain).

[0093] In other words, when a user terminal accesses an abandoned subdomain, it can avoid being hijacked by a recursive server and will be directly redirected to the target IP address pre-set in this invention, instead of being redirected to other advertising addresses. Therefore, if this invention does not pre-set the abandonIP (target IP address), intermediate operators and routers may return an advertising IP address themselves, leading to IP address hijacking.

[0094] Step S40: Send the target IP address to the user terminal device and access the target website page according to the target IP address.

[0095] As shown in Figure 9, step S40 specifically includes: step S41, sending the target IP address to the recursive server through the secondary domain authority server, and the recursive server sending the target IP address to the user terminal device.

[0096] Specifically, step S41 is implemented as follows: after determining the target IP address, the secondary domain authority server will send the target IP address to the recursive server (RecurDNS). Furthermore, RecurDNS will return AbandonIP (target IP address) to the Device (user terminal device).

[0097] Step S42: The user terminal device accesses a webpage based on the target IP address and enters the target website page corresponding to the target IP address.

[0098] Specifically, step S42 is implemented as follows: after the user terminal device receives the target IP address, it can access the webpage according to the target IP address and enter the target website page corresponding to the target IP address. The target website page will generally display an alternate page, such as the company homepage of example.cn.

[0099] Further, as shown in Figure 10, when a user terminal device receives an access request for the abandoned subdomain, the target IP address is extracted based on the access request and the domain alias record. Before this, the process includes: step S51, when the user terminal device accesses the main website webpage based on the abandoned subdomain; step S52, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record.

[0100] Further, as shown in Figure 11, when the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record. The process then includes: Step S61: When the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record; Step S62: If the main website webpage does not have a related URL link corresponding to the abandoned subdomain, it returns a "domain does not exist" result to the user terminal device.

[0101] Further, as shown in Figure 12, when the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record. The process then includes: Step S71: When the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record; Step S72: If the main website webpage does not have a related URL link corresponding to the abandoned subdomain, it returns a "domain does not exist" result to the user terminal device.

[0102] The technical effects of this invention are as follows: 1. By resolving the abandoned domain name to AbandonIP (target IP address), this invention can effectively prevent RecurDNS from hijacking the original NXDOMAIN abandoned domain name to HijackIP, thus effectively avoiding the leakage of user cookies and privacy data.

[0103] 2. This invention adds a well-known subdomain _abandon.example.cn and uses the CNAME record of the abandoned domain to ensure that if the relevant URL link to the abandoned domain is still retained on other accessible pages (such as example.cn), users can still access the AbandonIP controlled by the business party, effectively preventing the risk of hijacking of the remaining links of the abandoned domain.

[0104] 3. This invention replaces the wildcard domain *.example.cn with _abandon.example.cn, restricting the resolution of AbandonIP to only abandoned domains. Compared to *.example.cn, where any random subdomain can obtain a WildIP, this invention effectively mitigates the risk of DDoS attacks from random subdomains and enhances the service resilience of SLDServer and RecurDNS.

[0105] In addition, example.cn in this invention is an example second-level domain name. This invention is not limited to domain name levels and is applicable to hijacking defense of all related abandoned domain names in all second-level domains and below. Furthermore, this invention only requires the configuration of the domain name CNAME record, without modifying RecurDNS and SLDServer, improving the flexibility of operation and maintenance deployment. Moreover, this invention does not limit the DNS protocol extensions for DNS queries and responses and is fully compatible with international standard DNS extensions such as DoT, DoQ, and DNSSEC, enhancing service flexibility.

[0106] Furthermore, as shown in Figure 13, based on the above-mentioned security defense method for abandoned domain name hijacking, the present invention also provides a corresponding security defense system for abandoned domain name hijacking. The security defense system for abandoned domain name hijacking includes: a target IP address generation module 50, used to determine a target secondary domain, and perform subdomain creation and IP address configuration processing on the target secondary domain to obtain a target IP address; a domain alias record generation module 60, used to determine abandoned subdomains in the target secondary domain, and perform record deletion and domain record addition processing on the abandoned subdomains to obtain domain alias records; an abandoned subdomain access module 70, used to extract the target IP address based on the access request and the domain alias record when receiving an access request from a user terminal device for the abandoned subdomain; and a target IP address access module 80, used to send the target IP address to the user terminal device and access the target website page based on the target IP address.

[0107] As shown in Figure 14, another embodiment of the security defense system against abandoned domain name hijacking in this invention includes the following: In this embodiment, the target IP address generation module 50 includes: a target secondary domain determination unit 501, used to determine the target secondary domain and the corresponding authoritative server of the secondary domain; a subdomain creation processing unit 502, used to perform subdomain creation processing on the target secondary domain in the authoritative server of the secondary domain to obtain a well-known subdomain; and an IP address configuration unit 503, used to perform IP address configuration processing on the well-known subdomain in the authoritative server of the secondary domain to obtain a target IP address.

[0108] In this embodiment, the IP address configuration unit 503 includes: a configuration file acquisition subunit 5031, used to determine a preset IPv4 address record or a preset IPv6 address record, and acquire the authoritative server configuration file in the secondary domain authoritative server; and a configuration information addition subunit 5032, used to search for the configuration information of the well-known subdomain in the authoritative server configuration file, and when the configuration information in the authoritative server configuration file is found, to add the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

[0109] In this embodiment, the domain name alias record generation module 60 includes: an abandoned subdomain lookup unit 601, used to determine abandoned subdomains that need to be abandoned in the target second-level domain, and to search for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; and a domain name record addition unit 602, used to delete records of the abandoned subdomain information, and to add domain name records in the second-level domain authoritative server based on the abandoned subdomains and the well-known subdomains to obtain domain name alias records.

[0110] In this embodiment, the abandoned subdomain access module 70 includes: an access request receiving unit 701, configured to determine a recursive server when receiving an access request for the abandoned subdomain from a user terminal device, and send the access request and the domain alias record to the recursive server; and a target IP address extraction unit 702, configured to send the access request and the domain alias record to the secondary domain authority server through the recursive server, wherein the secondary domain authority server extracts the target IP address based on the access request and the domain alias record.

[0111] In this embodiment, the abandoned subdomain access module 70 further includes a related URL link judgment unit 703, which is used to determine whether the main site webpage has a related URL link corresponding to the abandoned subdomain when the user terminal device accesses the main site webpage based on the abandoned subdomain.

[0112] In this embodiment, the abandoned subdomain access module 70 further includes an access request receiving unit 704, which is used to receive the user terminal device's access request for the abandoned subdomain if the main site webpage has a related URL link corresponding to the abandoned subdomain.

[0113] In this embodiment, the target IP address access module 80 includes: a target IP address sending unit 801, used to send the target IP address to the recursive server through the secondary domain authority server, and the recursive server sends the target IP address to the user terminal device; and a target website page entry unit 802, used by the user terminal device to access a webpage based on the target IP address and enter the target website page corresponding to the target IP address.

[0114] Furthermore, as shown in Figure 15, based on the aforementioned security defense method and system for preventing hijacking of abandoned domain names, the present invention also provides a terminal, which includes a processor 10, a memory 20, and a display 30. Figure 15 only shows some components of the terminal; however, it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0115] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory. In other embodiments, the memory 20 may be an external storage device of the terminal, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc. Further, the memory 20 may include both internal and external storage devices. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code installed on the terminal. The memory 20 can also be used to temporarily store data that has been output or will be output. In one embodiment, the memory 20 stores a security defense program 40 for abandoned domain name hijacking, which can be executed by the processor 10 to implement the security defense method for abandoned domain name hijacking in this application.

[0116] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor, or other data processing chip, used to run program code stored in the memory 20 or process data, such as executing the security defense method against abandoned domain name hijacking.

[0117] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display 30 is used to display information on the terminal and to display a visual user interface. The terminal's processor 10, memory 20, and display 30 communicate with each other via a system bus.

[0118] In one embodiment, when the processor 10 executes the security defense program 40 for hijacking abandoned domain names in the memory 20, the following steps are performed: determining the target secondary domain, and performing subdomain creation and IP address configuration processing on the target secondary domain to obtain the target IP address; determining the abandoned subdomains in the target secondary domain, and performing record deletion and domain name record addition processing on the abandoned subdomains to obtain domain name alias records; when receiving an access request from a user terminal device for the abandoned subdomain, extracting the target IP address based on the access request and the domain name alias record; sending the target IP address to the user terminal device, and accessing the target website page based on the target IP address.

[0119] The process of determining the target secondary domain and performing subdomain creation and IP address configuration on the target secondary domain to obtain the target IP address specifically includes: determining the target secondary domain and determining the authoritative server corresponding to the target secondary domain; performing subdomain creation on the target secondary domain authoritative server to obtain a well-known subdomain; and performing IP address configuration on the well-known subdomain on the authoritative server to obtain the target IP address.

[0120] Specifically, the step of configuring the IP address of the well-known subdomain in the authoritative server of the secondary domain to obtain the target IP address includes: determining a preset IPv4 address record or a preset IPv6 address record, and obtaining the authoritative server configuration file in the authoritative server of the secondary domain; searching for the configuration information of the well-known subdomain in the authoritative server configuration file; and when the configuration information in the authoritative server configuration file is found, adding the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

[0121] The target IP address is either the configuration information of the well-known subdomain plus the preset IPv4 address record, or the configuration information of the well-known subdomain plus the preset IPv6 address record.

[0122] Specifically, the process of determining abandoned subdomains in the target second-level domain and performing record deletion and domain name record addition for the abandoned subdomains to obtain domain name alias records includes: determining abandoned subdomains in the target second-level domain that need to be abandoned, searching for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; deleting records of the abandoned subdomain information, and adding domain name records in the authoritative server of the second-level domain based on the abandoned subdomains and the well-known subdomains to obtain domain name alias records.

[0123] Specifically, when a user terminal device receives an access request for the abandoned subdomain, extracting the target IP address based on the access request and the domain alias record includes: upon receiving the access request for the abandoned subdomain, determining a recursive server and sending the access request and the domain alias record to the recursive server; the recursive server then sends the access request and the domain alias record to the secondary domain authority server, and the secondary domain authority server extracts the target IP address based on the access request and the domain alias record.

[0124] The step of extracting the target IP address based on the access request and the domain alias record when a user terminal device receives an access request for the abandoned subdomain includes, prior to: when the user terminal device accesses the main website webpage based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record.

[0125] The step of accessing the main website webpage by the user terminal device based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record, further includes: if the main website webpage has a related URL link corresponding to the abandoned subdomain, then receiving the access request from the user terminal device for the abandoned subdomain.

[0126] The step of accessing the main website webpage by the user terminal device based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record, further includes: if the main website webpage does not have a related URL link corresponding to the abandoned subdomain, then returning a domain name non-existent result to the user terminal device.

[0127] Specifically, sending the target IP address to the user terminal device and accessing the target website page based on the target IP address includes: sending the target IP address to the recursive server through the secondary domain authority server, and the recursive server sending the target IP address to the user terminal device; the user terminal device accessing the webpage based on the target IP address and entering the target website page corresponding to the target IP address.

[0128] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a security defense program for abandoned domain name hijacking, and the security defense program for abandoned domain name hijacking implements the steps of the security defense method for abandoned domain name hijacking as described above when executed by a processor.

[0129] In summary, this invention provides a security defense method, system, terminal, and computer-readable storage medium against hijacking of abandoned domain names. The method includes: determining a target second-level domain, and performing subdomain creation and IP address configuration processing on the target second-level domain to obtain a target IP address; determining abandoned subdomains in the target second-level domain, and performing record deletion and domain name record addition processing on the abandoned subdomains to obtain a domain alias record; when receiving an access request from a user terminal device for the abandoned subdomain, extracting the target IP address based on the access request and the domain alias record; sending the target IP address to the user terminal device, and accessing the target website page based on the target IP address. This invention, by adding a well-known subdomain and domain alias record, enables users to access the target IP address controlled by the business party even after the abandoned subdomain is deleted and related URL links remain, effectively defending against the hijacking risk of abandoned domain name legacy links.

[0130] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes that element.

[0131] Of course, those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.). The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The computer-readable storage medium can be a memory, magnetic disk, optical disk, etc.

[0132] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A security defense method for hijacking abandoned domain names, characterized in that, The security defense method against hijacking of abandoned domain names includes: identifying a target secondary domain, and performing subdomain creation and IP address configuration processing on the target secondary domain to obtain a target IP address; identifying abandoned subdomains in the target secondary domain, and performing record deletion and domain name record addition processing on the abandoned subdomains to obtain domain name alias records; when receiving an access request from a user terminal device for the abandoned subdomain, extracting the target IP address based on the access request and the domain name alias record; sending the target IP address to the user terminal device, and accessing the target website page based on the target IP address.

2. The security defense method against abandoned domain name hijacking according to claim 1, characterized in that, The process of determining the target secondary domain and performing subdomain creation and IP address configuration on the target secondary domain to obtain the target IP address specifically includes: determining the target secondary domain and determining the authoritative server corresponding to the target secondary domain; performing subdomain creation on the target secondary domain authoritative server to obtain a well-known subdomain; and performing IP address configuration on the well-known subdomain on the authoritative server to obtain the target IP address.

3. The security defense method against abandoned domain name hijacking according to claim 2, characterized in that, The step of configuring the IP address of the well-known subdomain in the authoritative server of the secondary domain to obtain the target IP address specifically includes: determining a preset IPv4 address record or a preset IPv6 address record, and obtaining the authoritative server configuration file in the authoritative server of the secondary domain; searching for the configuration information of the well-known subdomain in the authoritative server configuration file; when the configuration information in the authoritative server configuration file is found, adding the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

4. The security defense method against abandoned domain name hijacking according to claim 3, characterized in that, The target IP address is either the configuration information of the well-known subdomain plus the preset IPv4 address record, or the configuration information of the well-known subdomain plus the preset IPv6 address record.

5. The security defense method against abandoned domain name hijacking according to claim 3, characterized in that, The process of identifying abandoned subdomains in the target second-level domain and performing record deletion and domain name record addition for the abandoned subdomains to obtain domain name alias records specifically includes: identifying abandoned subdomains in the target second-level domain that need to be abandoned, searching for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; deleting records of the abandoned subdomain information, and adding domain name records in the authoritative server of the second-level domain based on the abandoned subdomains and the well-known subdomains to obtain domain name alias records.

6. The security defense method against abandoned domain name hijacking according to claim 2, characterized in that, When a user terminal device receives an access request for the abandoned subdomain, the step of extracting the target IP address based on the access request and the domain alias record specifically includes: when a user terminal device receives an access request for the abandoned subdomain, determining a recursive server and sending the access request and the domain alias record to the recursive server; the recursive server then sends the access request and the domain alias record to the secondary domain authority server, and the secondary domain authority server extracts the target IP address based on the access request and the domain alias record.

7. The security defense method against abandoned domain name hijacking according to claim 6, characterized in that, When a user terminal device receives an access request for the abandoned subdomain, the target IP address is extracted based on the access request and the domain alias record. Prior to this, the method further includes: when the user terminal device accesses the main website webpage based on the abandoned subdomain, determining whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record.

8. The security defense method against abandoned domain name hijacking according to claim 7, characterized in that, When the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record. Then, it further includes: if the main website webpage has a related URL link corresponding to the abandoned subdomain, it receives the access request from the user terminal device for the abandoned subdomain.

9. The security defense method against abandoned domain name hijacking according to claim 7, characterized in that, When the user terminal device accesses the main website webpage based on the abandoned subdomain, it determines whether the main website webpage has a related URL link corresponding to the abandoned subdomain based on the domain alias record. Then, it further includes: if the main website webpage does not have a related URL link corresponding to the abandoned subdomain, it returns a domain name non-existent result to the user terminal device.

10. The security defense method against abandoned domain name hijacking according to claim 6, characterized in that, The step of sending the target IP address to the user terminal device and accessing the target website page based on the target IP address specifically includes: sending the target IP address to the recursive server through the secondary domain authority server, and the recursive server sending the target IP address to the user terminal device; the user terminal device accessing the webpage based on the target IP address and entering the target website page corresponding to the target IP address.

11. A security defense system for hijacking abandoned domain names, characterized in that, The security defense system for hijacking abandoned domain names includes: a target IP address generation module, used to determine the target second-level domain, and perform subdomain creation and IP address configuration processing on the target second-level domain to obtain the target IP address; a domain alias record generation module, used to determine abandoned subdomains in the target second-level domain, and perform record deletion and domain record addition processing on the abandoned subdomains to obtain domain alias records; an abandoned subdomain access module, used to extract the target IP address based on the access request and the domain alias record when a user terminal device accesses the abandoned subdomain; and a target IP address access module, used to send the target IP address to the user terminal device and access the target website page based on the target IP address.

12. The security defense system for hijacking abandoned domain names according to claim 11, characterized in that, The target IP address generation module includes: a target secondary domain determination unit, used to determine the target secondary domain and the corresponding secondary domain authority server; a subdomain creation processing unit, used to perform subdomain creation processing on the target secondary domain in the secondary domain authority server to obtain a well-known subdomain; and an IP address configuration unit, used to perform IP address configuration processing on the well-known subdomain in the secondary domain authority server to obtain a target IP address.

13. The security defense system for hijacking abandoned domain names according to claim 12, characterized in that, The IP address configuration unit includes: a configuration file acquisition subunit, used to determine a preset IPv4 address record or a preset IPv6 address record, and acquire the authoritative server configuration file in the secondary domain authoritative server; and a configuration information addition subunit, used to search for the configuration information of the well-known subdomain in the authoritative server configuration file, and when the configuration information in the authoritative server configuration file is found, to add the preset IPv4 address record or the preset IPv6 address record to the configuration information to obtain the target IP address.

14. The security defense system for hijacking abandoned domain names according to claim 13, characterized in that, The domain alias record generation module includes: an abandoned subdomain lookup unit, used to determine abandoned subdomains that need to be abandoned in the target second-level domain, and to search for all records of the abandoned subdomains in the authoritative server configuration file to obtain abandoned subdomain information; and a domain record addition unit, used to delete records of the abandoned subdomain information, and to add domain records in the authoritative server of the second-level domain based on the abandoned subdomains and the well-known subdomains to obtain domain alias records.

15. The security defense system for hijacking abandoned domain names according to claim 12, characterized in that, The abandoned subdomain access module includes: an access request receiving unit, configured to determine a recursive server when receiving an access request for the abandoned subdomain from a user terminal device, and send the access request and the domain alias record to the recursive server; and a target IP address extraction unit, configured to send the access request and the domain alias record to the secondary domain authority server through the recursive server, wherein the secondary domain authority server extracts the target IP address based on the access request and the domain alias record.

16. The security defense system for hijacking abandoned domain names according to claim 15, characterized in that, The abandoned subdomain access module further includes a related URL link determination unit, used to determine whether the main site webpage has a related URL link corresponding to the abandoned subdomain when the user terminal device accesses the main site webpage based on the abandoned subdomain, according to the domain alias record.

17. The security defense system for hijacking abandoned domain names according to claim 16, characterized in that, The abandoned subdomain access module further includes an access request receiving unit, used to receive the user terminal device's access request for the abandoned subdomain if the main site webpage has a relevant URL link corresponding to the abandoned subdomain.

18. The security defense system for hijacking abandoned domain names according to claim 15, characterized in that, The target IP address access module includes: a target IP address sending unit, used to send the target IP address to the recursive server through the secondary domain authority server, and the recursive server to send the target IP address to the user terminal device; and a target website page entry unit, used by the user terminal device to access a webpage based on the target IP address and enter the target website page corresponding to the target IP address.

19. A terminal, characterized in that, The terminal includes: a memory, a processor, and a security defense program for abandoned domain name hijacking stored in the memory and executable on the processor. When the security defense program for abandoned domain name hijacking is executed by the processor, it implements the steps of the security defense method for abandoned domain name hijacking as described in any one of claims 1-14.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a security defense program for abandoned domain name hijacking, which, when executed by a processor, implements the steps of the security defense method for abandoned domain name hijacking as described in any one of claims 1-14.

Images