Description

Detects AWS Route53 registered domains that have domain transfer lock disabled. Domain transfer lock is a critical security control that prevents unauthorized transfers of domains to other registrars. Domains without transfer lock enabled are vulnerable to domain hijacking attempts.

Detection Strategy

• Scans all domains registered through AWS Route53 in the account

• Checks if the domain's StatusList includes the 'clientTransferProhibited' flag

• Reports a vulnerability if the transfer lock protection flag is not present for any domain

• Each vulnerable domain is reported individually with its domain name and status information