26 Cloud Takeover Fingerprints

Vulnerability Mechanism: An orphan CNAME points to an Amazon S3 bucket that was deleted or never created. An attacker can create the S3 bucket with the exact matching name in any AWS account and host arbitrary payloads or phishing pages on your domain.

Remediation Action: Delete the dangling CNAME DNS record in your DNS provider immediately, or re-create the target S3 bucket under your own AWS account with appropriate public-access block controls.

Vulnerability Mechanism: A CNAME references an unallocated or deleted CloudFront distribution. If an attacker knows the target, they can attempt to bind the custom domain to a newly provisioned CloudFront distribution.

Remediation Action: Remove the dangling CNAME or ensure the CloudFront distribution is active with an attached ACM SSL certificate covering the custom domain.

Vulnerability Mechanism: A custom domain points via CNAME to a user.github.io host, but no GitHub repository currently claims this custom domain in its CNAME file. An attacker can create a public repo with a CNAME file claiming your domain.

Remediation Action: Remove the CNAME DNS record pointing to *.github.io, or configure a verified GitHub repository in your organization with this custom domain and enforce HTTPS.

Vulnerability Mechanism: A custom domain points via CNAME to Vercel edge routers, but no deployment is linked to this domain. Attackers can add the unverified domain to their own project.

Remediation Action: Delete the CNAME pointing to Vercel or link the domain in your verified Vercel team dashboard with team domain verification enabled.

Vulnerability Mechanism: An Azure App Service plan or slot was deleted while the DNS CNAME record remains active. Any Azure customer can create an App Service with the unallocated subdomain prefix and claim ownership.

Remediation Action: Delete the dangling CNAME record from your authoritative DNS zone or re-bind the custom domain to an active Azure App Service plan.

Vulnerability Mechanism: A DNS record points to a decommissioned Heroku dyno. An adversary can register a new Heroku application, attach your custom domain via the Heroku CLI, and immediately serve content under your authoritative domain.

Remediation Action: Delete the dangling CNAME in DNS, or re-attach the domain to an active Heroku application inside your verified team account.

Vulnerability Mechanism: A subdomain mapped to Shopify has been disconnected from an active store. An attacker can connect the domain to an arbitrary Shopify account and display custom storefront content.

Remediation Action: Delete the CNAME pointing to myshopify.com or claim the domain in your verified Shopify admin dashboard.

Vulnerability Mechanism: The CNAME points to Fastly edge routers, but no Fastly service is currently configured to handle requests for this host. Anyone with a Fastly account can claim the domain on their service.

Remediation Action: Delete the Fastly CNAME record from DNS or add the domain to your authorized Fastly service.

Vulnerability Mechanism: An organization's help center CNAME points to a Zendesk instance that has been closed or renamed. Attackers can register a new trial Zendesk instance with the same subdomain mapping.

Remediation Action: Delete the host mapping CNAME in DNS or verify host mapping settings in your active Zendesk Admin Center.

Vulnerability Mechanism: A custom domain points to Cargo Collective portfolio hosting where the project was deleted. Attackers can register the abandoned Cargo slug and map the domain.

Remediation Action: Remove the Cargo CNAME record in DNS or re-bind the custom domain in Cargo Collective.

Vulnerability Mechanism: A marketing landing page on Unbounce was deleted while DNS remains pointed. Attackers can claim the custom domain on Unbounce.

Remediation Action: Delete the CNAME record pointing to unbouncepages.com.

Vulnerability Mechanism: Knowledge base CNAME points to Help Scout Docs where the documentation site has been removed.

Remediation Action: Remove the Help Scout CNAME in DNS or re-configure custom domain mapping in Help Scout.

Vulnerability Mechanism: CNAME points to Webflow edge proxies without an active site custom domain binding.

Remediation Action: Remove the Webflow CNAME in DNS or attach the domain in your Webflow project settings.

Vulnerability Mechanism: HubSpot marketing page CNAME was unlinked from a portal while DNS remains active.

Remediation Action: Delete the HubSpot CNAME record in DNS.

Vulnerability Mechanism: A Strikingly website was deleted without removing the custom domain CNAME record in DNS.

Remediation Action: Delete the Strikingly CNAME record from authoritative DNS.

Vulnerability Mechanism: An Elastic Beanstalk environment was terminated, releasing the regional subdomain prefix back to the public pool. Attackers can provision a new Beanstalk app with the identical environment name.

Remediation Action: Delete the CNAME record or recreate the Elastic Beanstalk environment in the same AWS region.

Vulnerability Mechanism: Surge.sh static site hosting was decommissioned without cleaning up the CNAME record. Any user running the Surge CLI can deploy a project claiming this exact domain name.

Remediation Action: Remove the Surge CNAME record from DNS or redeploy a verified project using the Surge CLI.

Vulnerability Mechanism: Documentation CNAME points to an unclaimed or deleted Readme project. Anyone can register the matching project subdomain on Readme.io.

Remediation Action: Delete the CNAME pointing to Readme.io or configure the project slug within your Readme.io dashboard.

Vulnerability Mechanism: CNAME points to an expired Ghost Pro publication. Attackers can claim the slug on Ghost Pro if unallocated.

Remediation Action: Remove the Ghost CNAME record in DNS.

Vulnerability Mechanism: A status page was decommissioned but the custom domain CNAME record still resolves to Atlassian Statuspage edge.

Remediation Action: Delete the CNAME record in DNS or re-link your Statuspage organization.

Vulnerability Mechanism: A WordPress or Drupal environment on Pantheon was deleted while DNS remains pointed. Attackers can claim the site slug.

Remediation Action: Remove the CNAME pointing to Pantheon or re-associate the custom domain.

Vulnerability Mechanism: CNAME points to an unmapped WordPress.com blog. Attackers can map the custom domain to their personal WordPress.com site.

Remediation Action: Delete the CNAME in DNS or add domain mapping in your WordPress.com account.

Vulnerability Mechanism: CNAME points to Tumblr edge without a registered blog mapping the custom domain.

Remediation Action: Remove the CNAME DNS record.

Vulnerability Mechanism: A custom domain points to Netlify, but no site claims the domain. An attacker can assign the domain to their Netlify project.

Remediation Action: Remove the Netlify CNAME or re-assign the custom domain in your Netlify site settings.

Vulnerability Mechanism: A custom domain points to Firebase Hosting edge without an active project binding. Attackers can claim unallocated project IDs.

Remediation Action: Delete the CNAME pointing to Firebase or link your custom domain in the Firebase Console.

Vulnerability Mechanism: CNAME points to Bitbucket Cloud Pages where the workspace or repository has been renamed or deleted.

Remediation Action: Remove the CNAME pointing to bitbucket.io.