Report URI highlights abandoned CDN domain risk and pushes CSP reporting

A domain formerly used by a content delivery network was re-registered in July 2025, and thousands of websites, code repositories and documentation pages still reference hostnames beneath it. The new owner holds wildcard DNS across the domain, so any hostname under it now resolves to infrastructure that person controls, while the pages themselves show no sign of having broken.

Report URI, a client-side security platform, points to the June 2024 polyfill.io case, where a JavaScript shim embedded in more than 110,000 sites changed ownership and began serving conditional redirects to mobile visitors, as evidence that third-party scripts can turn hostile long after deployment.

The company argues that Content Security Policy in report-only mode lets organisations measure which scripts actually execute in users’ browsers without blocking anything. It cites alerts from September 2026 that surfaced compromised e-commerce sites running a ClickFix social-engineering campaign, with attacker-controlled hostnames reported by browsers while reputation services still rated the domains clean.

Report URI says its platform hashes and archives scripts served to real users, checks hostnames against threat intelligence and monitors policies for drift. It notes that PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025 for organisations handling card payments.