# Bulgaria - Subdomain takeover of mail.starbucks.bg

mail.starbucks.bg pointed to an unclaimed mail service at icn.bg, letting the researcher claim it and send email as @mail.starbucks.bg.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: nukedx
- Disclosed: 2019-12-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/736863
- Library page: https://bugbountylibrary.com/r/h1%3A736863
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:email technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** mail.starbucks.bg subdomain / icn.bg mail hosting service
**Root cause:** DNS for mail.starbucks.bg pointed to a mail service hosted by icn.bg that was no longer claimed/registered, allowing anyone to register the service profile and control mail for the subdomain.
**Steps:**
1. Scan Rapid7 fdns dataset for `*.starbucks.*` records.
2. Identify mail.starbucks.bg pointing to an icn.bg mail service.
3. Confirm icn.bg does not host the domain (unclaimed).
4. Claim the subdomain profile on icn.bg web panel and set login credentials.
5. Configure a valid email server and send a test email from an @mail.starbucks.bg address as PoC.
**How found:** Academic research on cloud services; knowing Starbucks had historic subdomain takeover reports, scanned the Rapid7 fdns dataset for `*.starbucks.*` and spotted mail.starbucks.bg pointing to an unclaimed icn.bg service.
**Exploitation:** Researcher registered the dangling mail service profile at icn.bg, configured credentials via the web panel, and sent email from an @mail.starbucks.bg address, demonstrating control of mail for the subdomain.
**Insight:** Public DNS datasets (Rapid7 fdns) can be mined for dangling records to third-party mail/hosting providers; even mail-only takeover (no web content) is rewarded, so check MX/CNAME targets to niche regional providers, not just major clouds.