An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
A vulnerability exists where third-party scripts, often unknowingly integrated into websites, can be silently controlled by external actors. This is exacerbated by the fact that many organizations lack visibility into the code actually running on their sites due to a reliance on server-side security tools. The article highlights a growing trend of using Content Security Policy (CSP) in report-only mode to identify and investigate these third-party scripts, particularly in light of increasing PCI DSS compliance requirements. The technique, known as Report URI, allows security teams to build a comprehensive inventory of running scripts and proactively detect malicious activity, even if the scripts were initially approved.
In July 2025, a domain previously belonging to a content delivery network (CDN) was re-registered by an unknown party. Thousands of websites, code repositories, and documentation pages continue to reference hostnames associated with this re-registered domain, despite the CDN having been wound down years earlier. The new owner now uses wildcard DNS across the entire domain, resolving all hostnames to infrastructure under their control. This pattern isn't unique; in June 2024, the polyfill.io domain, embedded in over 110,000 sites, underwent a similar change, leading to redirects and ultimately a social-engineering campaign using the "ClickFix" family of malware.
Server-side tools like static analysis and dependency scanning are ineffective against these third-party scripts because they are fetched by the visitor's browser from a server not controlled by the organization. This creates a significant blind spot, as malicious code can operate with full privileges, reading DOM, accessing form fields, cookies, and local storage, and making outbound requests to hostile infrastructure. The browser is the only observer, and a Content Security Policy (CSP) can be used to monitor and report on this activity in report-only mode.
PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 mandate a comprehensive inventory of all scripts on payment pages, requiring assurance of integrity and a mechanism to detect unauthorized modifications. Report URI provides a solution by collecting data from the browser, identifying third-party scripts, and tracking changes over time.
Deploying Report URI involves simply adding an HTTP response header and monitoring the data for 48 hours. The resulting list of running scripts is often far more extensive than anticipated, revealing a significant gap in visibility. The adoption of CSP for report-only mode has grown dramatically over the past decade, increasing by over 12,000%. This shift reflects a broader trend towards understanding what code is actually executed by users’ browsers, not just what is deployed on the server. Report URI is a client-side security platform that answers the questions a security team cannot otherwise answer about its own site: which third parties are executing code on your pages? Which changed since yesterday? Which are taking data or communicating with infrastructure known to be hostile?