# [CRITICAL]-Taking over entire subdomain of romit.io

Dangling CNAME for blog.romit.io pointed to wordpress.com; researcher claimed the subdomain by mapping it to a new WordPress account for $13, becoming admin.

- Payout: $513
- Severity: high
- Program: Enter
- Credited: eh0x01
- Disclosed: 2016-10-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/173681
- Library page: https://bugbountylibrary.com/r/h1%3A173681
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Subdomain blog.romit.io with dangling CNAME to wordpress.com
**Root cause:** DNS CNAME for blog.romit.io still pointed to wordpress.com after the original WordPress site was removed, leaving the subdomain unclaimed and available for anyone to map.
**Steps:**
1. Recon reveals `blog.romit.io` returns WordPress error 'this domain has not been mapped with wordpress.com'
2. Create a free wordpress.com account
3. Add `blog.romit.io` as a custom domain and pay the $13 mapping fee
4. Visit `https://blog.romit.io` — now serves attacker-controlled WordPress content
**How found:** During recon, noticed blog.romit.io returned a WordPress 'domain not mapped' error, indicating a dangling CNAME to wordpress.com that could be claimed.
**Exploitation:** Attacker registers a WordPress.com account, pays the domain mapping fee, and binds the dangling subdomain to their own blog, gaining full control of content served at blog.romit.io under the victim's brand.
**Insight:** WordPress.com (and similar SaaS) custom-domain mappings are claimable by anyone once the original owner detaches; a 'domain not mapped' error page is a direct signal of a takeover opportunity, not just a broken link.