Who actually owns evil.com and the other tutorial domains
evil.com has been registered since 1995, hacker.com since 1994. We checked eighteen placeholder domains from security writing. All eighteen are owned.
Security writing needs a villain’s address. The convention is to invent something that reads as obviously fictional — evil.com, attacker.com, malicious.com — and move on to the interesting part, which is the vulnerability.
Those addresses are not fictional. We queried the public RDAP records for eighteen names that turn up in tutorials, advisories and sample configs.
Eighteen out of eighteen are registered. Not one was available.
The list
Checked 2026-07-25 against the Verisign RDAP service. Registration dates and registrars are public record; registrant identities are not shown here, because for most of these they are not public and guessing would be worse than saying nothing.
| Domain | Registered since | Registrar |
|---|---|---|
| hacker.com | 1994-08-22 | MarkMonitor Inc. |
| evil.com | 1995-04-10 | Network Solutions, LLC |
| evil.net | 1995-05-24 | Amazon Registrar, Inc. |
| mysite.com | 1995-09-07 | CSC Corporate Domains, Inc. |
| yoursite.com | 1996-02-12 | Sea Wasp, LLC |
| yourdomain.com | 1997-05-20 | GoDaddy.com, LLC |
| phishing.com | 1998-03-24 | MarkMonitor Inc. |
| malicious.com | 1998-08-07 | GoDaddy.com, LLC |
| attacker.com | 1999-03-06 | Epik LLC |
| testsite.com | 1999-11-12 | GoDaddy.com, LLC |
| evilcorp.com | 1999-12-15 | Squarespace Domains II LLC |
| malware.com | 2000-03-25 | Tucows Domains Inc. |
| badsite.com | 2000-08-09 | GoDaddy.com, LLC |
| malicious.net | 2001-04-18 | GoDaddy.com, LLC |
| notreal.com | 2001-09-13 | GoDaddy Online Services Cayman Islands Ltd. |
| badguy.com | 2002-05-10 | Key-Systems GmbH |
| attacker.net | 2004-08-14 | PDR Ltd. |
| attacker-controlled.com | 2025-10-21 | SNAPNAMES 77, LLC |
hacker.com predates the first browser war. evil.com was registered five months later. Several of these have been continuously renewed for three decades, which costs real money every year and implies somebody decided they were worth keeping.
Two details stand out without needing any speculation about who the owners are.
Some sit at registrars whose business is corporate brand protection. MarkMonitor and CSC Corporate Domains are not where hobbyists park a joke domain; they are where large organisations manage portfolios. hacker.com, phishing.com and mysite.com are administered there.
One was caught by a drop-catcher, recently. attacker-controlled.com was registered in October 2025 through SnapNames, a service that exists to grab domains the moment they expire. Somebody was watching that name.
Why this is more than a curiosity
An example domain is only an example while it stays inside prose. The moment it leaves — and it always leaves — it becomes a destination.
A proof of concept is written to be executed. Someone reproducing a vulnerability pastes the payload into their own environment, and the exfiltration target in that payload resolves. A config snippet gets copied into a real config file, committed, deployed. A test fixture outlives the person who wrote it and keeps making outbound requests on every CI run for years.
At that point the placeholder is infrastructure, pointed at a server somebody else controls.
Nothing about this requires anyone to act maliciously. It only requires the example to be copied faithfully, which is exactly what a good example invites.
The name this site is on
This project exists because of one gap in that list.
attacker-controlled-site.com appeared for years in vulnerability writeups, blog posts and vendor documentation — as the reverse-proxy target in an NGINX hijacking writeup, as the destination for a poisoned password-reset link, as the endpoint in a header-based exfiltration example. It was as fictional-sounding as evil.com.
Unlike evil.com, it was still registrable. It was registered in July 2026, by us, specifically so that it would not be registered by anyone else. The reference index lists every use we have verified against the live source.
The difference between those two cases is nothing but luck and timing. evil.com was claimed thirty years ago by someone who got there first. This one sat open, in public documentation, indexed and quotable, for as long as it took someone to notice.
What to do instead
The fix costs nothing. There are names reserved by standard for exactly this purpose, and they cannot be registered by anyone: .example, .test, .invalid, plus example.com and its siblings.
Write attacker.example. It carries the identical meaning, it is unambiguous to any reader, and it can never resolve to a stranger’s server.
The longer version, with the places people forget →
Method: registration data retrieved from the public Verisign RDAP endpoint on 2026-07-25. The raw responses are stored in the repository alongside the script that produced them, so the table can be re-checked or extended.