HIGH SEVERITYHOSTINGCVSS 8.6Immediate (<90s)ID: netlify
Netlify Dangling DNS & Takeover Fingerprint
A custom domain points to Netlify, but no site claims the domain. An attacker can assign the domain to their Netlify project.
DNS CNAME Delegation Rules
*.netlify.app
CNAME resolves to *.netlify.app. Returns 404 with 'Not Found - Request ID'.
404 Not Found
Authoritative Response Token
“Not Found - Request ID”
curl -sI http://subdomain.example.com | grep 'Not Found - Request ID'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Remove the Netlify CNAME or re-assign the custom domain in your Netlify site settings.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.netlify.app. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove dangling Netlify CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Netlify Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Netlify Takeover FAQs
Netlify offers apex domain verification, but subdomains with direct CNAMEs can be claimed unless DNS ownership is verified.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Netlify Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.