MEDIUM SEVERITYCMSCVSS 7.5Requires Account VerificationID: ghost-cms
Ghost CMS Dangling DNS & Takeover Fingerprint
CNAME points to an expired Ghost Pro publication. Attackers can claim the slug on Ghost Pro if unallocated.
DNS CNAME Delegation Rules
*.ghost.io
CNAME points to ghost.io. Body returns 'The thing you were looking for is gone'.
404 Not Found
Authoritative Response Token
“The thing you were looking for is gone”
curl -sI http://subdomain.example.com | grep 'The thing you were looking for is gone'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Remove the Ghost CNAME record in DNS.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.ghost.io. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove Ghost CMS CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Ghost CMS Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Ghost CMS Takeover FAQs
Delete the custom domain CNAME pointing to *.ghost.io in your DNS manager.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Ghost CMS Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.