Old CDN Domain Resold: Thousands of Sites Still Loading Code From a Stranger

Security researchers have flagged a quietly dangerous situation: a domain that once belonged to a shut-down content delivery network (CDN) was allowed to expire, then re-registered by an unknown party in July 2025. Thousands of websites, code repositories and documentation pages still contain hard-coded references to hostnames under that domain. Because the new owner controls wildcard DNS across the entire domain, they can decide what code loads on any of those sites at any time, and none of the affected site owners have been notified because nothing visibly broke.

This is not a one-off. In June 2024, the widely used polyfill.io script, embedded in more than 110,000 sites, changed hands and began serving malicious redirects to mobile visitors. In both cases, the sites were never hacked directly. They simply linked to an external script years earlier and never revisited that decision.

The core problem is that third-party scripts run with the same access as a site's own code: they can read what visitors type, access cookies and stored data, and send information anywhere on the internet. Because these scripts can behave differently depending on who is viewing the page, standard security scans often miss the risk entirely, making this a blind spot for many businesses that rely on external code without ongoing oversight.