Domain Shadowing

In an attack that includes domain shadowing, an attacker will log into the domain register's website to set up a new subdomain registered to a new server IP address. By registering many subdomain names and IP addresses, attackers are able to avoid blacklists, but it does not allow attackers to bypass reputation-based filters.


ref:
http://searchsecurity.techtarget.com/answer/What-is-domain-shadowing-and-how-can-enterprises-defend-against-it