CRITICAL SEVERITYHOSTINGCVSS 9.1Immediate (<90s)ID: heroku
Heroku App Dangling DNS & Takeover Fingerprint
A DNS record points to a decommissioned Heroku dyno. An adversary can register a new Heroku application, attach your custom domain via the Heroku CLI, and immediately serve content under your authoritative domain.
DNS CNAME Delegation Rules
*.herokudns.com / *.herokuapp.com
CNAME points to *.herokuapp.com or *.herokudns.com. Returns 404 'No such app'.
404 / 502
Authoritative Response Token
“No such app”
curl -sI http://subdomain.example.com | grep -i 'no such app'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Delete the dangling CNAME in DNS, or re-attach the domain to an active Heroku application inside your verified team account.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.herokudns.com / *.herokuapp.com. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Purge stale CNAME in Route53 or Cloudflare pointing to heroku
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Heroku App Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Heroku App Takeover FAQs
Older Heroku apps used *.herokuapp.com, while modern applications use automated ACM certificates on *.herokudns.com. Both are vulnerable to dangling CNAME exploitation if the application is deleted.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Heroku App Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.
Related Cloud Provider Signatures (6)
View All 26 Signatures →HOSTINGHIGH
Shopify Storefront
*.myshopify.com
HOSTINGHIGH
Webflow
proxy.webflow.com / proxy-ssl.webflow.com
HOSTINGHIGH
Strikingly
*.strikinglydns.com
CLOUDCRITICAL
Microsoft Azure App Service
*.azurewebsites.net / *.cloudapp.net / *.trafficmanager.net
DNSHIGH
Fastly CDN
*.fastly.net
CLOUDCRITICAL
AWS S3
*.s3.amazonaws.com / *.s3-website-*.amazonaws.com