CRITICAL SEVERITYHOSTINGCVSS 9.1Immediate (<90s)ID: surge-sh
Surge.sh Dangling DNS & Takeover Fingerprint
Surge.sh static site hosting was decommissioned without cleaning up the CNAME record. Any user running the Surge CLI can deploy a project claiming this exact domain name.
DNS CNAME Delegation Rules
*.surge.sh
CNAME points to surge.sh. Web server returns 'project not found'.
404 Not Found
Authoritative Response Token
“project not found”
curl -sI http://subdomain.example.com | grep 'project not found'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Remove the Surge CNAME record from DNS or redeploy a verified project using the Surge CLI.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.surge.sh. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove Surge.sh CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Surge.sh Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Surge.sh Takeover FAQs
Running `surge --domain subdomain.example.com` will immediately publish the local directory to the domain if no other Surge user has claimed it.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Surge.sh Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.
Related Cloud Provider Signatures (7)
View All 26 Signatures →HOSTINGHIGH
Pantheon Hosting
*.pantheonsite.io
HOSTINGHIGH
Netlify
*.netlify.app
HOSTINGHIGH
Firebase Hosting
*.web.app / *.firebaseapp.com
CLOUDCRITICAL
AWS Elastic Beanstalk
*.elasticbeanstalk.com
CMSHIGH
Readme.io
*.readme.io
CMSMEDIUM
Ghost CMS
*.ghost.io
CLOUDCRITICAL
AWS S3
*.s3.amazonaws.com / *.s3-website-*.amazonaws.com