HIGH SEVERITYCMSCVSS 8.6Immediate (<90s)ID: wordpress-com
WordPress.com Dangling DNS & Takeover Fingerprint
CNAME points to an unmapped WordPress.com blog. Attackers can map the custom domain to their personal WordPress.com site.
DNS CNAME Delegation Rules
*.wordpress.com
CNAME points to wordpress.com. Returns 'Do you want to register this domain?'.
302 / 404
Authoritative Response Token
“Do you want to register this domain?”
curl -sI http://subdomain.example.com | grep 'Do you want to register this domain?'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Delete the CNAME in DNS or add domain mapping in your WordPress.com account.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.wordpress.com. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove WordPress.com CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss WordPress.com Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
WordPress.com Takeover FAQs
Yes. If a domain points to WordPress.com edge servers without an active mapping, any paid WordPress.com user can map it.
FREE UNRESTRICTED SCANNER
Scan Your Domain for WordPress.com Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.