# Subdomain Takeover: Starbucks points to Azure

Starbucks subdomain svcgatewayus.starbucks.com had a dangling A record to a deleted Azure Cloud Service, allowing an attacker to claim the cloudapp.net resource and serve content on the Starbucks domain.

- Payout: $2,000
- Severity: medium
- Program: Starbucks
- Credited: Patrik Hudak
- Disclosed: 2018-06-25
- Write-up quality: 6/10
- Original: https://0xpatrik.com/subdomain-takeover-starbucks/
- Library page: https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks
- Tags: domain:cloud impact:integrity kind:bounty platform:blog sev:medium tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Azure Cloud Service (cloudapp.net) A-record subdomain
**Root cause:** The subdomain's A record pointed to a dedicated Azure Cloud Service IP whose resource no longer existed (NXDOMAIN), and Azure assigns dedicated IPs rather than virtual hosts, so anyone recreating a Cloud Service with the matching name could claim the IP.
**Steps:**
1. `dig -t A svcgatewayus.starbucks.com` returns NXDOMAIN, indicating the Azure resource is gone
2. Note the A record target 1fd05821-7501-40de-9e44-17235e7ab48b.cloudapp.net
3. Create a new Cloud Service in the Azure portal with the matching custom domain name
4. Create a Storage Account for the Cloud Service
5. Build a simple ASP.NET web app in Visual Studio and deploy it to the Cloud Service
6. HTTP requests to svcgatewayus.starbucks.com now return the attacker's ASP.NET content
**How found:** Enumerated subdomains and checked DNS; observed svcgatewayus.starbucks.com returned NXDOMAIN for its A record pointing to a cloudapp.net address, hypothesizing the Azure resource was deleted and reclaimable.
**Exploitation:** Attacker registers the dangling Azure Cloud Service name, deploys an ASP.NET app, and the victim domain's A record resolves to the attacker-controlled service, serving arbitrary content under the Starbucks origin.
**Insight:** For Azure Cloud Services and Azure Websites, the takeover signal is DNS NXDOMAIN on the A record, not an HTTP 404 — because Azure assigns dedicated IPs instead of virtual hosts, so a 404 alone does not indicate takeover potential.