attacker-controlled-site.com
Published 2026-07-25

Who actually owns evil.com and the other tutorial domains

evil.com has been registered since 1995, hacker.com since 1994. We checked eighteen placeholder domains from security writing. All eighteen are owned.

Security writing needs a villain’s address. The convention is to invent something that reads as obviously fictional — evil.com, attacker.com, malicious.com — and move on to the interesting part, which is the vulnerability.

Those addresses are not fictional. We queried the public RDAP records for eighteen names that turn up in tutorials, advisories and sample configs.

Eighteen out of eighteen are registered. Not one was available.

The list

Checked 2026-07-25 against the Verisign RDAP service. Registration dates and registrars are public record; registrant identities are not shown here, because for most of these they are not public and guessing would be worse than saying nothing.

Domain Registered since Registrar
hacker.com 1994-08-22 MarkMonitor Inc.
evil.com 1995-04-10 Network Solutions, LLC
evil.net 1995-05-24 Amazon Registrar, Inc.
mysite.com 1995-09-07 CSC Corporate Domains, Inc.
yoursite.com 1996-02-12 Sea Wasp, LLC
yourdomain.com 1997-05-20 GoDaddy.com, LLC
phishing.com 1998-03-24 MarkMonitor Inc.
malicious.com 1998-08-07 GoDaddy.com, LLC
attacker.com 1999-03-06 Epik LLC
testsite.com 1999-11-12 GoDaddy.com, LLC
evilcorp.com 1999-12-15 Squarespace Domains II LLC
malware.com 2000-03-25 Tucows Domains Inc.
badsite.com 2000-08-09 GoDaddy.com, LLC
malicious.net 2001-04-18 GoDaddy.com, LLC
notreal.com 2001-09-13 GoDaddy Online Services Cayman Islands Ltd.
badguy.com 2002-05-10 Key-Systems GmbH
attacker.net 2004-08-14 PDR Ltd.
attacker-controlled.com 2025-10-21 SNAPNAMES 77, LLC

hacker.com predates the first browser war. evil.com was registered five months later. Several of these have been continuously renewed for three decades, which costs real money every year and implies somebody decided they were worth keeping.

Two details stand out without needing any speculation about who the owners are.

Some sit at registrars whose business is corporate brand protection. MarkMonitor and CSC Corporate Domains are not where hobbyists park a joke domain; they are where large organisations manage portfolios. hacker.com, phishing.com and mysite.com are administered there.

One was caught by a drop-catcher, recently. attacker-controlled.com was registered in October 2025 through SnapNames, a service that exists to grab domains the moment they expire. Somebody was watching that name.

Why this is more than a curiosity

An example domain is only an example while it stays inside prose. The moment it leaves — and it always leaves — it becomes a destination.

A proof of concept is written to be executed. Someone reproducing a vulnerability pastes the payload into their own environment, and the exfiltration target in that payload resolves. A config snippet gets copied into a real config file, committed, deployed. A test fixture outlives the person who wrote it and keeps making outbound requests on every CI run for years.

At that point the placeholder is infrastructure, pointed at a server somebody else controls.

Nothing about this requires anyone to act maliciously. It only requires the example to be copied faithfully, which is exactly what a good example invites.

The name this site is on

This project exists because of one gap in that list.

attacker-controlled-site.com appeared for years in vulnerability writeups, blog posts and vendor documentation — as the reverse-proxy target in an NGINX hijacking writeup, as the destination for a poisoned password-reset link, as the endpoint in a header-based exfiltration example. It was as fictional-sounding as evil.com.

Unlike evil.com, it was still registrable. It was registered in July 2026, by us, specifically so that it would not be registered by anyone else. The reference index lists every use we have verified against the live source.

The difference between those two cases is nothing but luck and timing. evil.com was claimed thirty years ago by someone who got there first. This one sat open, in public documentation, indexed and quotable, for as long as it took someone to notice.

What to do instead

The fix costs nothing. There are names reserved by standard for exactly this purpose, and they cannot be registered by anyone: .example, .test, .invalid, plus example.com and its siblings.

Write attacker.example. It carries the identical meaning, it is unambiguous to any reader, and it can never resolve to a stranger’s server.

The longer version, with the places people forget →


Method: registration data retrieved from the public Verisign RDAP endpoint on 2026-07-25. The raw responses are stored in the repository alongside the script that produced them, so the table can be re-checked or extended.