DNS shadowing is the abuse of a legitimate domain’s DNS records or subdomains to make malicious pages appear connected to a trusted organization. Attackers may create unauthorized hostnames under a school, government, or business domain while leaving its main website unchanged.
This matters because users and search engines may trust the familiar parent domain, helping attackers give fraudulent content an appearance of legitimacy or draw traffic to it. Defenders should monitor DNS changes, investigate unfamiliar subdomains, and verify that record updates match approved administrative activity. An intact homepage does not rule out abuse elsewhere in the domain’s DNS.