Act
active
Abandoned CDN Domain Re-Registered; Thousands of Sites Still Reference It
- Engineer — Act: This mirrors the Polyfill.io hijack pattern — any hard-coded reference to the re-registered CDN hostnames in your repos, docs, or build artifacts now loads content from an untrusted owner. Audit all codebases, IaC, and documentation for references to the named CDN hostnames and replace or remove them immediately.
- SOC/IR — Plan: No confirmed malicious payload delivery is noted yet, but the new owner could begin serving malicious scripts at any time. Build a detection rule for outbound DNS/HTTP connections to the re-registered domain, and queue a proxy-log hunt back to the re-registration date of July 2025.
- Leader — Plan: This is a recurring supply-chain risk class — abandoned third-party asset domains re-registered for abuse (analogous to Polyfill.io). Use this as a trigger to establish or reaffirm a policy requiring engineering teams to audit hard-coded external CDN dependencies on a regular cadence.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.