SUBSTACK DOMAIN TAKEOVER

Summary from the TLDR InfoSec newsletter

Substack allows writers to use custom domains for their blogs by creating a CNAME record pointing to Substack's servers. However, Substack does not authenticate that a customer owns a domain at this step. Attackers can potentially hijack inactive custom domains previously connected to Substack blogs, even though Substack charges a $50 fee for the feature.