HIGH SEVERITYHOSTINGCVSS 8.6Immediate (<90s)ID: pantheon
Pantheon Hosting Dangling DNS & Takeover Fingerprint
A WordPress or Drupal environment on Pantheon was deleted while DNS remains pointed. Attackers can claim the site slug.
DNS CNAME Delegation Rules
*.pantheonsite.io
CNAME points to pantheonsite.io. Web response contains '404 Unknown Site'.
404 Not Found
Authoritative Response Token
“404 Unknown Site”
curl -sI http://subdomain.example.com | grep '404 Unknown Site'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Remove the CNAME pointing to Pantheon or re-associate the custom domain.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.pantheonsite.io. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove Pantheon hosting CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Pantheon Hosting Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Pantheon Hosting Takeover FAQs
Ensure the custom domain is removed from Pantheon dashboard before deleting the environment, then purge DNS records.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Pantheon Hosting Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.
Related Cloud Provider Signatures (7)
View All 26 Signatures →HOSTINGHIGH
Netlify
*.netlify.app
HOSTINGHIGH
Firebase Hosting
*.web.app / *.firebaseapp.com
HOSTINGMEDIUM
Bitbucket Cloud
bitbucket.io
DNSMEDIUM
Atlassian Statuspage
*.statuspage.io
CMSHIGH
WordPress.com
*.wordpress.com
CMSMEDIUM
Tumblr
*.tumblr.com
CLOUDCRITICAL
AWS S3
*.s3.amazonaws.com / *.s3-website-*.amazonaws.com