# Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium servers

Badoo subdomain badootech.badoo.com pointed to Medium's servers via unclaimed custom-domain DNS records, enabling subdomain takeover for phishing once Medium relaunched the service.

- Payout: hidden
- Severity: medium
- Program: Bumble
- Found by: w2w
- Disclosed: 2020-12-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1034023
- Library page: https://bugbountylibrary.com/r/h1%3A1034023
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** DNS records / Medium custom domain hosting
**Root cause:** Subdomain DNS A records were pointed at Medium's custom-domain infrastructure without the domain being claimed on Medium, leaving it dangling and claimable by anyone.
**Steps:**
1. Resolve `badootech.badoo.com` and observe A records pointing to Medium AWS IPs (52.x.x.x).
2. Visit the subdomain and see Medium's 'Oops! We couldn't find that page' page with Medium icon.
3. Compare DNS to a known Medium custom domain (extranewsfeed.com) and confirm identical records.
4. Follow Medium's custom-domain setup: submit publication URL, registered domain, and registrar to Medium support.
5. Since DNS records already exist, skip the registrar step; once Medium relaunches custom domains, the domain would be attached to attacker's blog.
**How found:** Researcher noticed a newly pushed subdomain, saw it served a Medium 404 page, checked DNS and found Medium's A records, then compared against a known Medium custom domain to confirm the dangling setup.
**Exploitation:** Attacker requests Medium support to attach badootech.badoo.com to their own Medium publication; existing DNS records satisfy Medium's verification, so the subdomain would serve attacker-controlled content for phishing. Blocked at time of report because Medium paused the custom-domain service.
**Insight:** A 404 page bearing a third-party SaaS brand (Medium, Shopify, etc.) on a company subdomain signals an unclaimed custom-domain binding; compare DNS against known customers of that SaaS to confirm takeover feasibility.