42 Cloud Takeover Fingerprints

Vulnerability Mechanism: An orphan CNAME points to an Amazon S3 bucket that was deleted or never created. An attacker can create the S3 bucket with the exact matching name in any AWS account and host arbitrary payloads or phishing pages on your domain.

Remediation Action: Delete the dangling CNAME DNS record in your DNS provider immediately, or re-create the target S3 bucket under your own AWS account with appropriate public-access block controls.

Vulnerability Mechanism: A custom domain points via CNAME to a user.github.io host, but no GitHub repository currently claims this custom domain in its CNAME file. An attacker can create a public repo with a CNAME file claiming your domain.

Remediation Action: Remove the CNAME DNS record pointing to *.github.io, or configure a verified GitHub repository in your organization with this custom domain and enforce HTTPS.

Vulnerability Mechanism: A DNS record points to a decommissioned Heroku dyno. An adversary can register a new Heroku application, attach your custom domain via the Heroku CLI, and immediately serve content under your authoritative domain.

Remediation Action: Delete the dangling CNAME in DNS, or re-attach the domain to an active Heroku application inside your verified team account.

Vulnerability Mechanism: An Azure App Service plan or slot was deleted while the DNS CNAME record remains active. Any Azure customer can create an App Service with the unallocated subdomain prefix and claim ownership.

Remediation Action: Delete the dangling CNAME record from your authoritative DNS zone or re-bind the custom domain to an active Azure App Service plan.

Vulnerability Mechanism: A CNAME references an unallocated or deleted CloudFront distribution. If an attacker knows the target, they can attempt to bind the custom domain to a newly provisioned CloudFront distribution.

Remediation Action: Remove the dangling CNAME or ensure the CloudFront distribution is active with an attached ACM SSL certificate covering the custom domain.

Vulnerability Mechanism: An Elastic Beanstalk environment was terminated, releasing the regional subdomain prefix back to the public pool. Attackers can provision a new Beanstalk app with the identical environment name.

Remediation Action: Delete the CNAME record or recreate the Elastic Beanstalk environment in the same AWS region.

Vulnerability Mechanism: The CNAME points to Fastly edge routers, but no Fastly service is currently configured to handle requests for this host. Anyone with a Fastly account can claim the domain on their service.

Remediation Action: Delete the Fastly CNAME record from DNS or add the domain to your authorized Fastly service.

Vulnerability Mechanism: A subdomain mapped to Shopify has been disconnected from an active store. An attacker can connect the domain to an arbitrary Shopify account and display custom storefront content.

Remediation Action: Delete the CNAME pointing to myshopify.com or claim the domain in your verified Shopify admin dashboard.

Vulnerability Mechanism: Surge.sh static site hosting was decommissioned without cleaning up the CNAME record. Any user running the Surge CLI can deploy a project claiming this exact domain name.

Remediation Action: Remove the Surge CNAME record from DNS or redeploy a verified project using the Surge CLI.

Vulnerability Mechanism: An organization's help center CNAME points to a Zendesk instance that has been closed or renamed. Attackers can register a new trial Zendesk instance with the same subdomain mapping.

Remediation Action: Delete the host mapping CNAME in DNS or verify host mapping settings in your active Zendesk Admin Center.

Vulnerability Mechanism: Documentation CNAME points to an unclaimed or deleted Readme project. Anyone can register the matching project subdomain on Readme.io.

Remediation Action: Delete the CNAME pointing to Readme.io or configure the project slug within your Readme.io dashboard.

Vulnerability Mechanism: CNAME points to an expired Ghost Pro publication. Attackers can claim the slug on Ghost Pro if unallocated.

Remediation Action: Remove the Ghost CNAME record in DNS.

Vulnerability Mechanism: A status page was decommissioned but the custom domain CNAME record still resolves to Atlassian Statuspage edge.

Remediation Action: Delete the CNAME record in DNS or re-link your Statuspage organization.

Vulnerability Mechanism: A WordPress or Drupal environment on Pantheon was deleted while DNS remains pointed. Attackers can claim the site slug.

Remediation Action: Remove the CNAME pointing to Pantheon or re-associate the custom domain.

Vulnerability Mechanism: CNAME points to an unmapped WordPress.com blog. Attackers can map the custom domain to their personal WordPress.com site.

Remediation Action: Delete the CNAME in DNS or add domain mapping in your WordPress.com account.

Vulnerability Mechanism: CNAME points to Tumblr edge without a registered blog mapping the custom domain.

Remediation Action: Remove the CNAME DNS record.