Researcher: Shubham Bothra
This page demonstrates that rwa.imkey.im is vulnerable to subdomain takeover via an abandoned Vercel deployment.
The DNS CNAME for rwa.imkey.im points to Vercel (cname.vercel-dns.com) but no Vercel project was claiming this domain. Any attacker with a free Vercel account can register this subdomain and serve arbitrary content under the trusted imkey.im domain.
This finding has been reported responsibly to the imKey security team at support@imkey.im.
No real imKey systems were harmed. This is a proof of concept only. Please remove the dangling CNAME record or re-point it to a valid Vercel project.