SCARP
CS-1038
Illustrative — not customer data
Report date: 21 August 2026
Prepared for: illustrative B2B SaaS attack surface
Change-set review
CS-1038: Subdomain takeover
3 paths · 7 evidence entries · Owner Infrastructure
Decision
Remove the dangling DNS records
Deletes the CNAMEs that point at released resources, so nobody can claim them under your domain.
- Owner
- Infrastructure
- Effort / disruption
- 1 day · Low
- Projection confidence
- 92%
Projected
3
paths expected removed
Realized
2
paths confirmed removed
Remaining
1
path still reachable after re-check
Still reachable after re-check
events.example still points at the cancelled landing page: its record lives in a DNS zone the outside agency manages, which the change did not reach.
Change-set comparison
The selected change is shown beside the alternative that was considered. Only the selected change shipped, so only it has a re-check result.
Illustrative alternatives
Selected change
Remove the dangling DNS records
- Owner
- Infrastructure
- Effort
- 1 day
- Disruption
- Low
- Expected paths removed
- 3
- Realized paths removed
- 2
Considered, not shipped
Reclaim the released resources
- Owner
- Cloud engineering
- Effort
- 2 days
- Disruption
- Low
- Expected paths removed
- 2
- Realized paths removed
- Not re-checked
Audit closure line · 21 August 2026
Change set CS-1038, owned by Infrastructure, was reviewed under the 5-day SLA. Observation obs_8f2a and closure closure_8f2a tie the projected 3-path reduction to 2 paths confirmed removed, with 1 of 3 still reaching the asset; verification: DNS resolution and provider-claim check for each subdomain.
Evidence register
Illustrative data — not customer output.
| Stage | Entity | Detail | Evidence | Source | Confidence | Freshness |
|---|---|---|---|---|---|---|
| entry | promo.example | CNAME to a deleted cloud storage bucket | observed | Passive external observation | 95% | 18 Aug 2026, 16:40 UTC |
| entry | status-old.example | CNAME to a released hosting app | observed | Passive external observation | 95% | 18 Aug 2026, 16:40 UTC |
| entry | events.example | CNAME to a cancelled landing page, in a DNS zone run by an outside agency | observed | Passive external observation | 95% | 18 Aug 2026, 16:41 UTC |
| control | Dangling DNS records | Each target name is unclaimed and can be registered by anyone | validated | Operator-authorized validation | 97% | 19 Aug 2026, 10:05 UTC |
| asset | Parent-domain sessions | Session cookies scoped to every subdomain | inferred | Reachability correlation | 72% | 18 Aug 2026, 16:45 UTC |
| asset | Brand trust | Pages served under the company domain | inferred | Reachability correlation | 72% | 18 Aug 2026, 16:45 UTC |
| impact | Session theft and phishing | Attacker content served from a trusted subdomain | inferred | Reachability correlation | 72% | 18 Aug 2026, 16:45 UTC |