Can attackers phish customers using a hijacked Help Scout domain?

HIGH SEVERITYCMSCVSS 8.6Immediate (<90s)ID: help-scout

Help Scout Docs Dangling DNS & Takeover Fingerprint

Knowledge base CNAME points to Help Scout Docs where the documentation site has been removed.

DNS CNAME Delegation Rules

Target CNAME Delegation

*.helpdocs.io

DNS Resolution Indicator

CNAME points to helpdocs.io. Body returns 'No settings were found for this company'.

Expected HTTP Status Code

404 Not Found

Authoritative Response Token

Vulnerable Body Indicator String

“No settings were found for this company”

CLI Verification Command

curl -sI http://subdomain.example.com | grep 'No settings were found for this company'

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Immediate Action Required: Remove the Help Scout CNAME in DNS or re-configure custom domain mapping in Help Scout.

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to *.helpdocs.io.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

# Delete Help Scout docs CNAME

Open Dedicated Help Scout Docs Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss Help Scout Docs Takeovers

Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

Help Scout Docs Takeover FAQs

Yes. Knowledge bases are trusted by customers. Attackers can post fake troubleshooting advice or download links containing malware.

FREE UNRESTRICTED SCANNER

Scan Your Domain for Help Scout Docs Orphans

Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.

LAUNCH TAKEOVER TOOL →Start Free 24/7 Monitor