# The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Managed DNS providers let anyone claim a domain's zone without ownership verification, enabling takeover of 120K+ orphaned domains across AWS, GCP, Rackspace, DigitalOcean.

- Payout: $1,337
- Severity: high
- Program: Google, Amazon, Rackspace, DigitalOcean
- Credited: Matthew Bryant
- Disclosed: 2016-12-05
- Write-up quality: 8/10
- Original: https://thehackerblog.com/the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-and-digital-ocean/index.html
- Library page: https://bugbountylibrary.com/r/blog%3Athehackerblog-com-the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-a
- Tags: domain:cloud impact:data-leak impact:integrity kind:bounty platform:blog sev:high tech:aws tech:gcp technique:recon vuln:access-control vuln:misconfiguration vuln:subdomain-takeover

**Target:** Managed DNS zone import (Route53, Cloud DNS, Rackspace Cloud DNS, DigitalOcean)
**Root cause:** Providers allow creating a DNS zone for a domain without verifying ownership; if a zone is deleted but the registrar still points NS at the provider, anyone can re-create the zone and receive the same nameservers.
**Steps:**
1. Enumerate .com/.net zone files (Verisign) to find domains whose NS are provider nameservers.
2. Query `dig NS <domain>`; SERVFAIL/REFUSED indicates orphaned zone.
3. Resolve actual NS via `dig NS <domain> @a.gtld-servers.net`.
4. Create zone in provider panel/API for the domain; check returned nameservers.
5. For Route53, loop create/delete zones until each target NS is matched in separate zones, then replicate records across them.
6. For Rackspace/DO, single create suffices since NS set is fixed.
7. Add arbitrary A/MX/TXT records to control the domain.
**How found:** Prior DigitalOcean research suggested provider-specific bug; author hypothesized it was systemic and tested the same zone-import flow against other managed DNS providers, using TLD zone files to enumerate candidates and SERVFAIL as a signal.
**Exploitation:** Attacker creates a zone for the orphaned domain, obtains the same nameservers the registrar points to, then sets arbitrary records to host phishing/malware sites, issue TLS certs, and receive email for the domain.
**Escalation:** Scale via bulk enumeration of TLD zone files to find 120K+ vulnerable domains; Route53 single-NS-per-zone trick to reconstruct full NS set.
**Insight:** SERVFAIL/REFUSED on an NS query against a provider's nameservers is a fingerprint of an orphaned zone — enumerate TLD zone files for domains pointing at a provider, then probe each for that error before attempting zone creation.