DNS/CDN/frontend hash drift

Evidence summary #

T-09 phase-2 signal. Historical: Nov 2023 DNS hijack of frax.com and frax.finance via Name.com registrar-level compromise — resolved within ~24h, no funds lost. Post-incident domain security posture: no public confirmation of DNSSEC deployment, no certificate-transparency monitoring feed publicly documented, no hash-baseline for production JS bundles established. No current DNS/frontend drift detected via available public channels as of 2026-05-17. Yellow posture: prior exploited attack surface (registrar-level) confirmed; structural vulnerability persists without evidence of remediation. T-09 phase-2 signal (requires external monitoring stack for production). Current state: no-fire today per observable evidence, but structural gap means the signal would not reliably alert if drift occurred.

Sources #

Methodology #

Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.

See the full factor methodology and distribution across all protocols →