What kind of subdomain is _dc-max.124d5522827b

Question

I have used a tool for finding subdomains of a website, and among others (such as www.xyz.co.uk, mail.xyz.co.uk), it has found a subdomain _dc-max.124d5522827b.xyz.co.uk, which seems odd.

To investigate further, I did nslookup and found the following:

Besides, the tool that found this subdomain does give an IP address, and "Axigen WebMail" in the Server-Banner field. Reverse nslookup of this IP address gives a totally different domain address, say abc.def.net.uk. Browsing abc.def.net.uk or the IP address in the web browser gives the login page of Axigen WebMail, and which contains no branding or text related to the original website XYZ.

My question is that what kind of subdomain is this, if it is legit at all?

Answer 1

Services often use randomly generated subdomains to verify their customers' ownership of a domain. It's especially common with SEO tools, which may only want to share data they have on a domain with the actual owner of that domain. Here's how it works:

1. A service needs to verify that a user owns a domain (for example, example.com).

2. The service generates a DNS record containing a random string (for example, TXT seoservice-verify.example.com "123456789".

3. As the owner of example.com, the user adds the DNS record to their domain.

4. The service does a DNS lookup and sees that the record is in place and correct. This means the customer has control over the domain's DNS zone, and thus that the customer has some level of administrative access to the domain.

It's worth mentioning that tools that find subdomains sometimes do so by combing through the certificate transparency logs, which I believe are only written to if a web server is configured to host at that subdomain (and is configured to request a HTTPS certificate for it). For details on CT logs and subdomains, see the following related posts:

How did someone discover my new URL so fast?
Is it possible to keep the existence of a domain secret?

Answer 2

This subdomain, _dc-max.124d5522827b.xyz.co.uk, looks like it was automatically generated, likely for internal or technical purposes rather than public use. The fact that it points to an IP address with a different domain and shows a generic login page suggests it could be linked to a service provider or a third-party tool used by the original domain. If it doesn't seem related to the main site and no branding is present, it might be worth investigating further, but it doesn't necessarily indicate anything malicious.