Summary
Security researcher reports sally.loadmagic.ai points to a decommissioned AWS IP (13.236.249.115, ap-southeast-2), creating a subdomain takeover vulnerability. The dangling record is a remnant of the May 2026 migration from Sydney to London. An attacker could claim the IP and serve malicious content or steal cookies scoped to .loadmagic.ai.
Details
Subdomain: sally.loadmagic.ai | Dangling IP: 13.236.249.115 | Region: ap-southeast-2 (decommissioned). Reporter claims CVSS 8.2. Fix: delete the DNS A/CNAME record for sally. Also audit all other *.loadmagic.ai subdomains for stale Sydney-region references from the migration.
Reporter
Omri (GalaxySec)
Metadata
- Type: bug
- Severity: high
- Source: Email triage (auto-classified)
- Email ID:
19fca0c51c376a3f
Summary
Security researcher reports sally.loadmagic.ai points to a decommissioned AWS IP (13.236.249.115, ap-southeast-2), creating a subdomain takeover vulnerability. The dangling record is a remnant of the May 2026 migration from Sydney to London. An attacker could claim the IP and serve malicious content or steal cookies scoped to .loadmagic.ai.
Details
Subdomain: sally.loadmagic.ai | Dangling IP: 13.236.249.115 | Region: ap-southeast-2 (decommissioned). Reporter claims CVSS 8.2. Fix: delete the DNS A/CNAME record for sally. Also audit all other *.loadmagic.ai subdomains for stale Sydney-region references from the migration.
Reporter
Omri (GalaxySec)
Metadata
19fca0c51c376a3f