CRITICAL SEVERITYHOSTINGCVSS 9.1Immediate (<90s)ID: github-pages
GitHub Pages Dangling DNS & Takeover Fingerprint
A custom domain points via CNAME to a user.github.io host, but no GitHub repository currently claims this custom domain in its CNAME file. An attacker can create a public repo with a CNAME file claiming your domain.
DNS CNAME Delegation Rules
*.github.io
CNAME points to *.github.io. HTTP returns 404 with GitHub error body.
404 Not Found
Authoritative Response Token
“There isn't a GitHub Pages site here”
curl -sI https://subdomain.example.com | grep 'There isn\'t a GitHub Pages site here'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Remove the CNAME DNS record pointing to *.github.io, or configure a verified GitHub repository in your organization with this custom domain and enforce HTTPS.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.github.io. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Delete orphaned GitHub Pages DNS record
# Or add GitHub Organization Domain Verification TXT record
resource "aws_route53_record" "github_verify" {
name = "_github-pages-challenge-yourorg.example.com"
type = "TXT"
records = ["your_github_token"]
}ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss GitHub Pages Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
GitHub Pages Takeover FAQs
GitHub allows organizations to verify apex domain ownership via DNS TXT records. Once verified, other GitHub users cannot claim subdomains under your verified domain, even if a CNAME accidentally points to github.io.
Because any free GitHub user can create a public repository, commit a single CNAME file containing your domain, and instantly serve malicious JavaScript or credential harvesting forms over HTTPS.
FREE UNRESTRICTED SCANNER
Scan Your Domain for GitHub Pages Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.
Related Cloud Provider Signatures (6)
View All 26 Signatures →HOSTINGHIGH
Vercel
*.vercel-dns.com / cname.vercel-dns.com
HOSTINGCRITICAL
Heroku App
*.herokudns.com / *.herokuapp.com
HOSTINGHIGH
Shopify Storefront
*.myshopify.com
CLOUDCRITICAL
AWS CloudFront
*.cloudfront.net
CLOUDCRITICAL
Microsoft Azure App Service
*.azurewebsites.net / *.cloudapp.net / *.trafficmanager.net
CLOUDCRITICAL
AWS S3
*.s3.amazonaws.com / *.s3-website-*.amazonaws.com