Subdomain and script host takeover

A name that points at a service nobody runs any more can be claimed by anyone.

What it is

A DNS record can still point at a hosting service after the project behind it is deleted. The service then answers that no site is there, and whoever creates a project with that name on the service controls what the name serves. The same applies to a script host: your page loads a script from a name that no longer exists.

Why it matters

A taken over subdomain serves content under your domain, with your cookies in scope and your name in the address bar. A taken over script host runs the attacker's code on every page that loads it. A script host reported for serving malicious code is the same problem with a different cause.

How Tenty checks it

Tenty looks up the DNS records of the names in your certificate and the hosts of your scripts. When a record points at GitHub Pages, Heroku, Netlify, Vercel, Amazon S3 or Surge, it asks for the page and reads the answer. The takeover check runs for verified owners only.

How to fix it

Remove the DNS record, or create the project again on the service so that the name belongs to you. For script hosts, remove the tag or load the file from your own host.

How to reproduce

dig +short CNAME YOUR-SUBDOMAIN
curl -sS 'https://YOUR-SUBDOMAIN/'

The first line names the target. The second shows the answer of the service.