https://viglianisi.eu/tags/subdomain-takeover/Recent content in Subdomain-Takeover on Emanuele ViglianisiHugoenMon, 24 Aug 2026 00:00:00 +0000https://viglianisi.eu/posts/subdomain-takeover-github-pages/Mon, 24 Aug 2026 00:00:00 +0000https://viglianisi.eu/posts/subdomain-takeover-github-pages/<p>Some time ago, I received a security alert from Google: a new owner had verified one of the subdomains of my domain in their own Google Search Console. I do not remember having given anybody permission to do that, so I started investigating.</p> <p>After a few minutes of digging, the picture was clear: someone was serving an Indonesian online gambling site on <code>ftp.viglianisi.eu</code>, a subdomain of <em>my</em> domain.</p> <div class="highlight"><pre tabindex="0" style="color:#e6edf3;background-color:#0d1117;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-fallback" data-lang="fallback"><span style="display:flex;"><span>$ curl -s http://ftp.viglianisi.eu/ </span></span><span style="display:flex;"><span>&lt;title&gt;POWERPLAY128 Bandar SV388 Agen Judi Sabung Ayam&lt;/title&gt; </span></span><span style="display:flex;"><span>... </span></span><span style="display:flex;"><span>Server: GitHub.com </span></span></code></pre></div><p>Served by GitHub.com, on my domain. My first reaction was to check everything: passwords, active sessions, account activity. Nothing. Nobody had hacked me. Not my GitHub account, not my OVH account, not my Google account. So how was that possible?</p>