The Indian financial internet, mapped as attack surface
.bank.in is the de-facto namespace for Indian banking web presences — yet no registry publishes the full subdomain list. This audit discovers and probes the whole namespace, exposing it as flat, open data for security research, DNS monitoring, vendor attack-surface mapping and DPI transparency.
The namespace, measured
Live probes run daily via GitHub Actions. Current master snapshot (all six namespaces):
| Namespace | Probed | Resolves | HTTP 200 | Verdict |
|---|---|---|---|---|
| *.bank.in | 4,199 | 1,680 | 941 | Real RBI bank deployments |
| *.fin.in | 376 | 0 | 0 | Zone exists, no deployments |
| *.insurance.in | 376 | 0 | 0 | Zone exists, parked apex |
| *.nbfc.in | 376 | 1 | 0 | Single catch-all; not meaningful |
| *.npci.in | 376 | 352 | 352 | “Domain For Sale” parking wildcard |
| *.bank | 268 | 12 | 9 | Global fTLD; ≈12 Indian-prefix entities |
.bank.in is the only widely-deployed financial namespace in the .in space — roughly four-fifths of its live hosts are real bank subdomains. The other proposed financial TLDs remain largely inert, and .npci.in is a parking wildcard rather than a deployment.
The largest bank attack surfaces
Top banks by subdomain count — including a striking volume of UAT / test environments parked inside the banking namespace, which can act as stepping stones to live systems:
| Bank | Subdomains | Live | Bank | Subdomains | Live | |
|---|---|---|---|---|---|---|
| Axis | 421 | 125 | SBI | 291 | 71 | |
| SBI (UAT) | 256 | 64 | HDFC (UAT) | 242 | 61 | |
| IndusInd | 223 | 67 | HDFC | 169 | 60 | |
| PNB | 151 | 50 | Bank of India | 145 | 46 | |
| Indian Bank (UAT) | 83 | 15 | Yes Bank | 82 | 37 |
Across the namespace, more than 80 bank UAT environments reside under .bank.in, frequently running weaker controls — default credentials and debug endpoints — that widen the reachable attack surface.
Global .bank name collisions
On the global fTLD, identical prefixes can belong to different banks — a spoofing / brand-confusion hazard worth knowing:
- sbi.bank → Sovereign Bank International (US) — not SBI India
- bob.bank → Bank of Bahrain & Kuwait — not Bank of Baroda
- apgb.bank → Andhra Pradesh Grameena Bank (redirects to .bank.in)
- capital.bank, csb.bank, sbm.bank → genuine Indian deployments
TLS certificate landscape (from CT logs)
| Issuer | Certificates | Comment |
|---|---|---|
| DigiCert | 1,591 | dominant |
| Let's Encrypt / ZeroSSL | 602 | self-managed footprint |
| GlobalSign | 478 | |
| Sectigo | 392 | |
| eMudhra (Indian CA) | 179 | domestic issuance growing |
Related: the IDRBT registry investigation
A companion audit of the IDRBT Domain Registration Portal — the exclusive registry for .bank.in — found 33+ unauthenticated API endpoints exposing a user database of 5,576 records with bcrypt hashes, phantom test domains on NIXI, missing DMARC enforcement across 40% of the namespace, data-residency violations, and a vendor appointed without a visible tender. Reported to CERT-In; CERT-In confirmed the vulnerability fixed on 26 June 2026.
Data & reproductions
- Searchable live UI: ccagentorg.github.io/bank-domains-ui
- Open dataset (CSV / JSONL / Parquet / SQLite): CCAgentOrg/bank-in-domains — updated daily
- IDRBT open data: zo.pub/cashlessconsumer/idrbt-open-data
Sources: Wayback Machine CDX, HackerTarget certificate-transparency, live DNS + HTTPS probes. Full methodology is open and reproducible from the data repos.