Expired CDN Domain Hijacked Thousands of Sites
A dormant domain from a defunct content delivery network was re-registered in July 2025, silently redirecting traffic from thousands of live websites to a stranger's infrastructure without triggering any security alerts.
In July 2025, an individual registered a domain name that previously belonged to a content delivery network which had been shut down years earlier. The original provider had allowed the domain to expire, but thousands of websites, code repositories, and documentation pages still contain hard-coded references to hostnames under it. Because these references were never updated, the new owner now controls where that traffic goes.
The new registrant holds wildcard DNS permissions across the entire domain, meaning any subdomain resolves to infrastructure they control. Currently, the main address serves an ad-heavy media downloader page. The critical risk is not the current content, but the fact that a stranger decides what loads next for thousands of uninvolved site owners. No one has been notified because, from the outside, nothing appears broken.
Silent Shifts in Web Infrastructure
This incident is not unique. In June 2024, the polyfill.io domain, a JavaScript shim embedded in over 110,000 sites, changed ownership and began serving conditional redirects to mobile visitors. The sites using it were not hacked; they had simply outsourced a script tag years earlier and never revisited the decision. Both cases share a common flaw: the malicious code was never on the organization's server, and it arrived long after the last deployment.
As reported by The Hacker News, this pattern exposes a blind spot in standard security practices. Static analysis and dependency scanning examine what an organization builds and ships, but third-party scripts are fetched live by the visitor's browser from servers the organization does not control. This makes the response uniquely hostile to conventional testing, as it can vary based on geography, user agent, or time of day.
Limitations of Server-Side Scanning
Traditional security tools look in the wrong place because they assume code is static. A crawler pulling a file once from a data-center IP range might see a clean version, while a shopper on a mobile network in another country receives something more sinister. Since third-party scripts hold the same privileges as first-party code, they can read the DOM, capture form fields character by character, and make outbound requests to anywhere. Attacks of the Magecart type do not require a server breach; they only require one approved script tag to start behaving differently.
Browsers as Reliable Security Observers
The browser is the only observer reliably present for every page view. Content Security Policy, often discussed as a defense against cross-site scripting, has a second function useful for teams unsure of what code they are running. It can control which code is allowed to execute, block unauthorized code, and report when violations occur. These alerts come from real sessions, in real geographies, providing visibility into actual user experiences.
In September 2026, such alerts surfaced a cluster of compromised e-commerce sites running a social-engineering campaign. Base64-encoded loaders planted in CMS content created a fake verification overlay that placed a PowerShell command on the victim's clipboard. The attacker-controlled hostnames appeared in browser alerts while mainstream reputation services still rated the domains as clean. Scanners had not flagged the pages because, on the server, they appeared fine. This highlights the trade-off: server-side tools miss client-side shifts, but browser-based monitoring captures the reality of what users actually experience.
