A stranger holds wildcard DNS over a wound-down CDN's domain that thousands of pages still call

The re-registration happened in July 2025 ^[1]. The ClickFix cluster described in the same account is dated September 2026 ^[14]. That is roughly fourteen months between the handover and the write-up ^[1], and in that window nothing would have opened a ticket. The account withholds both the CDN's name and the domain, so no operator can grep their own repositories and templates for the hostnames ^[18][2].

A third-party script has the same privileges as the first-party code around it. It can read the DOM, read form fields character by character as they are typed, read cookies and local storage, and make outbound requests to anywhere ^[11]. Magecart-class theft works without a server breach: one approved script tag that starts behaving differently is enough ^[12].

Static analysis, dependency scanning and software composition analysis all examine what an organisation builds and ships. A script the visitor's browser fetches on every page view, from a server the organisation does not run, falls outside all three ^[9]. Pull the file yourself and you may well get a clean copy, because the response can vary by geography, user agent, referrer, time of day and session ^[10].

polyfill.io is the documented case. The shim was embedded in more than 110,000 sites when the domain changed ownership in June 2024 and began serving conditional redirects to mobile visitors ^[6]. No one broke into those sites. They had outsourced a script tag years earlier and never revisited the decision ^[7]. That happened thirteen months before this CDN domain was re-registered ^[2].

The browser is the one observer present for every page view, and the September 2026 case shows what it picks up. Alerts collected by Report URI surfaced a cluster of compromised e-commerce sites running a ClickFix-family campaign: base64-encoded loaders planted inside CMS content after an administrative compromise, chained through a redirector to a fake "verify you are human" overlay that placed a PowerShell command on the victim's clipboard and persisted it as a scheduled task ^[14]. Several of the attacker-controlled hostnames were still rated clean by mainstream reputation services when they turned up in those reports ^[15].

Report-only mode costs nothing to deploy. Content-Security-Policy-Report-Only leaves enforcement and blocking switched off, so a first deployment measures what runs without changing behaviour ^[16], and the account says most organisations find that list longer than they expected ^[17]. The inventory has a blind spot. A policy written from today's pages will include the stale CDN hostname, because the pages already call it, so whatever that host serves counts as authorised code; the reportable event is the payload's outbound request to a host the policy does not list ^[3].