An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
An expired CDN domain was re-registered with wildcard DNS while thousands of sites still load assets from it, reviving client-side supply chain risk.
In July 2025 an expired domain formerly used by a wound-down CDN was re-registered with wildcard DNS, while thousands of websites, repositories, and documentation pages still hard-code references to its hostnames. The precedent is polyfill.io, which changed ownership in June 2024 and served conditional redirects to visitors on more than 110,000 sites. In September 2026, Report URI CSP alerts surfaced compromised e-commerce sites running a ClickFix-style social engineering campaign using Base64 loaders, a fake 'verify you are human' overlay placing a PowerShell command on victims' clipboards, and scheduled-task persistence. The piece argues CSP report-only monitoring addresses PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, mandatory since March 31, 2025.
- Expired CDN domain re-registered July 2025; thousands of sites still reference its hostnames
- Apex now serves an ad-heavy media downloader; new owner controls downstream content
- Polyfill.io's 2024 ownership change similarly hit 110,000+ sites with conditional redirects
- Report URI CSP alerts surfaced September 2026 ClickFix campaign on compromised e-commerce sites
- PCI DSS 6.4.3 and 11.6.1 became mandatory March 31, 2025 for payment-page scripts
- Vendors
- Report URI
- Malware
- ClickFix
From the original article
5 min read at thehackernews.com
In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.