Preliminary research

Alias Equals Zone? Large-Scale and Stealthy Takeover of Domain Hosting Service via CNAME-Following Cross-Domain Verification

Ruixuan Li, Xingyu Zhao, Yunyi Zhang, Baojun Liu and Jun Shao · usenix.org

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Domain hosting providers misread CNAME semantics during ownership verification: a challenge token found after following a CNAME is accepted as proof of control over the aliasing domain, which itself configures no token. The resulting takeover, ALIASLEAP, affects four email and seven web hosting providers and over two million domains, 200K in the Tranco Top 1M. It is stealthy: the chains are legitimate.

Record

Researcher

Ruixuan Li, Xingyu Zhao, Yunyi Zhang, Baojun Liu and Jun Shao

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• dns
• domain-takeover
• auth-bypass
• email
• large-scale-scan
• measurement-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Ruixuan Li, Xingyu Zhao, Yunyi Zhang, Baojun Liu and Jun Shao, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.