Takeover risk

Unbounce subdomain takeover.

A subdomain still pointing at a Unbounce account that no longer exists is not untidy. It is claimable.

What it looks like

A subdomain on your domain has a CNAME record pointing at unbouncepages.com, and loading that subdomain returns Unbounce's unclaimed page rather than a working site. The visible signature is a page containing text along the lines of "The requested URL was not found on this server".

Both signals are needed. A CNAME pointing at Unbounce is completely normal when the service is in use. It only matters when the target is no longer claimed.

Why it can be taken over

Campaign landing pages are built, run, and cancelled. The DNS record survives the campaign.

What an attacker gets

  • Content served from your subdomain, on your domain, usually with a valid certificate that Unbounce issues automatically.
  • A phishing address that passes every check a cautious person would run, because it genuinely is your domain.
  • Access to any cookie your main site scopes to the parent domain, which can include session data.

How to fix it

Remove the record. Marketing subdomains such as go. offers. or try. are the usual pattern, and they are almost never audited because marketing set them up rather than IT.

The full removal steps for any provider are in the dangling record guide.

Stopping the next one

These appear whenever a hosted service is trialled and dropped, so a single cleanup does not settle it. The habit worth building is deleting the DNS record in the same sitting as the cancellation, because those are separate actions and only one of them is on anyone's mind.

Related

Check yours

See whether anything on your domain points nowhere.

The free subdomain check finds every name still resolving and confirms which targets are unclaimed.

Other services with the same risk

Each has its own detection signature and removal steps.

Amazon CloudFront · WordPress.com · Microsoft Azure · GitLab Pages · Zendesk · Intercom

All 24 in this set