HIGH SEVERITYHOSTINGCVSS 8.6Immediate (<90s)ID: shopify
Shopify Storefront Dangling DNS & Takeover Fingerprint
A subdomain mapped to Shopify has been disconnected from an active store. An attacker can connect the domain to an arbitrary Shopify account and display custom storefront content.
DNS CNAME Delegation Rules
*.myshopify.com
CNAME resolves to *.myshopify.com. Returns 404 with 'shop is currently unavailable'.
404 Not Found
Authoritative Response Token
“Sorry, this shop is currently unavailable”
curl -sI http://subdomain.example.com | grep 'Sorry, this shop is currently unavailable'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Delete the CNAME pointing to myshopify.com or claim the domain in your verified Shopify admin dashboard.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.myshopify.com. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Purge dangling Shopify CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Shopify Storefront Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Shopify Storefront Takeover FAQs
Yes. Attackers can configure their own payment gateway on a rogue Shopify store, tricking users who trust your corporate subdomain into submitting payment card details.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Shopify Storefront Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.
Related Cloud Provider Signatures (7)
View All 26 Signatures →HOSTINGHIGH
Webflow
proxy.webflow.com / proxy-ssl.webflow.com
HOSTINGHIGH
Strikingly
*.strikinglydns.com
HOSTINGCRITICAL
Surge.sh
*.surge.sh
HOSTINGCRITICAL
Heroku App
*.herokudns.com / *.herokuapp.com
DNSHIGH
Fastly CDN
*.fastly.net
CMSHIGH
Zendesk Help Center
*.zendesk.com
CLOUDCRITICAL
AWS S3
*.s3.amazonaws.com / *.s3-website-*.amazonaws.com