Subdomain Takeover Detection

Identify and prevent subdomain takeover vulnerabilities before attackers exploit them. Automated scanning detects dangling DNS records pointing to unclaimed cloud services across AWS, Azure, Heroku, GitHub, and 40+ platforms.

  • Detect dangling CNAME records in real-time
  • Verify service ownership across 40+ platforms
  • Immediate high-priority vulnerability alerts
  • Remediation guidance for each detection
  • Historical tracking of takeover risks
Start Vulnerability Scanning
Critical Subdomain Takeover Risk Detected
Subdomain: campaign.example.com
Service: AWS S3 Bucket
Issue: CNAME points to deleted S3 bucket
Impact: Attacker can claim bucket and control subdomain
Action Required: Remove DNS record or reclaim bucket
✓ 127 subdomains scanned
✗ 1 critical vulnerability found
⚠ 3 medium-risk findings

How Subdomain Takeover Attacks Work

Understanding the attack vector helps prevent exploitation

1

Service Provisioning

Your team creates a subdomain (promo.yourcompany.com) pointing to a cloud service like AWS S3, Heroku app, or GitHub Pages for a marketing campaign or temporary project.

2

Service Decommissioning

The project ends and the cloud resource is deleted—S3 bucket removed, Heroku app destroyed, or GitHub repository deleted. The DNS CNAME record remains active pointing to the now-unclaimed service.

3

Attacker Discovery

An attacker scans for dangling DNS records using automated tools. They identify that your subdomain points to a service identifier that no longer exists or is unclaimed.

4

Service Claiming

The attacker creates a new resource with the exact same identifier (S3 bucket name, Heroku app name, etc.). Your DNS record now resolves to their controlled resource.

5

Subdomain Control

The attacker now controls your subdomain and can host phishing pages, steal session cookies, distribute malware, damage brand reputation, or perform SEO poisoning—all appearing to come from your legitimate domain.

Why Subdomain Takeovers Are Critical

The impact extends beyond the compromised subdomain

Phishing Campaigns

Attackers host convincing phishing pages on your subdomain. Users trust the domain and enter credentials, payment information, or personal data. The attack appears legitimate because it uses your company's domain.

Session Cookie Theft

If your application sets cookies for the parent domain, the compromised subdomain can access those cookies. Attackers steal authentication tokens and session identifiers, gaining unauthorized access to user accounts.

Brand Reputation Damage

Malicious content hosted on your domain damages customer trust and brand reputation. Search engines may flag your entire domain. Customer complaints and negative media coverage follow when attacks are discovered.

SEO Poisoning

Attackers use your subdomain to host spam content, black-hat SEO pages, or malicious redirects. Your domain authority is exploited to rank their content. Google may penalize your entire domain in search results.

Compliance Violations

Subdomain takeovers may violate data protection regulations if customer information is exposed. Compliance frameworks (SOC 2, ISO 27001) require asset inventory management. Auditors flag dangling DNS records as security gaps.

Extended Dwell Time

Average time between service decommissioning and discovery is 6-12 months. Attackers have extended access to your subdomain during this period. The longer the exposure, the greater the potential damage and harder the cleanup.

Vulnerable Cloud Services We Monitor

Comprehensive coverage across 40+ cloud platforms and hosting services

AWS S3

Static website hosting on deleted buckets. Bucket names are globally unique and claimable.

Heroku

Deprovisioned apps with custom domains. App names can be recreated by attackers.

GitHub Pages

Deleted repositories with custom domains. Repository names are reclaimable.

Azure

Cloud Services, App Service, Traffic Manager endpoints. Deleted instances remain claimable.

Shopify

Deleted stores with custom domains. Store names can be registered by attackers.

Fastly

Removed CDN configurations. Service names become available for claiming.

CloudFront

Deleted distributions pointing to removed S3 origins or custom origins.

DigitalOcean

Deleted App Platform apps and Spaces buckets with custom domains.

Firebase

Deleted Firebase Hosting sites. Project identifiers can be reused.

Tumblr

Deleted blogs with custom domains. Blog names become available.

Vercel

Deleted deployments with custom domains. Project names can be claimed.

Netlify

Deleted sites with custom domains. Site names are reclaimable.

Our detection engine maintains an updated database of vulnerable service fingerprints across 40+ platforms. We continuously add new services as cloud providers evolve. Detection logic is updated weekly based on research from the security community and our own testing.

How Our Detection Works

Multi-stage verification process minimizes false positives

1. DNS Record Analysis

Extract all CNAME records from your subdomains. Identify records pointing to external services rather than your own infrastructure. Parse target hostnames to determine the cloud provider and service type. Filter out internal services and known safe configurations.

2. HTTP/HTTPS Probing

Attempt connections to each subdomain over HTTP and HTTPS. Record response codes, headers, and body content. Analyze redirect chains and certificate information. Measure response times and connection failures indicating service unavailability.

3. Fingerprint Matching

Compare response content against known vulnerable service fingerprints. Detect error messages like "NoSuchBucket" (AWS S3), "No such app" (Heroku), or "There isn't a GitHub Pages site here" (GitHub). Match HTTP status codes and headers characteristic of unclaimed services.

4. Service Verification

Perform platform-specific checks to verify the service doesn't exist or isn't owned by you. For AWS S3, verify bucket doesn't exist or has public access restrictions. For Heroku, check app existence via API. For GitHub, verify repository status.

5. False Positive Filtering

Eliminate false positives through multiple verification rounds. Recheck findings across different geographic locations. Verify consistency over multiple scan cycles. Filter out intentional redirects and maintenance pages that mimic vulnerability signatures.

6. Risk Classification

Assign severity levels based on exploitability and impact. Critical: Confirmed takeover vulnerability with simple exploitation. High: Likely vulnerable but requires additional verification. Medium: Suspicious configuration requiring investigation. Provide remediation guidance for each finding.

Detection Examples by Service

AWS S3 Bucket Takeover

DNS Record:
promo.example.com CNAME promo-bucket.s3.amazonaws.com
HTTP Response:
404 Not Found
<Error><Code>NoSuchBucket</Code></Error>
Detection:
✗ Critical - Bucket name is available to claim

Remediation: Either delete the DNS CNAME record immediately, or recreate the S3 bucket with the same name and configure proper bucket policies to prevent unauthorized access.

Heroku App Takeover

DNS Record:
staging.example.com CNAME staging-app.herokuapp.com
HTTP Response:
404 Not Found
No such app
Detection:
✗ Critical - Heroku app name is available

Remediation: Remove the CNAME record or recreate the Heroku app with the same name. If recreating, ensure proper access controls and monitoring are in place before updating DNS.

GitHub Pages Takeover

DNS Record:
docs.example.com CNAME company.github.io
HTTP Response:
404 Not Found
There isn't a GitHub Pages site here
Detection:
✗ Critical - Repository doesn't exist or Pages disabled

Remediation: Remove the DNS record or recreate the GitHub repository with Pages enabled. Verify the custom domain configuration in GitHub repository settings matches your DNS records.

Prevention Best Practices

Coordinate DNS and Service Changes

When decommissioning cloud services, remove DNS records simultaneously—not as a separate cleanup task. Implement deployment pipelines that automatically remove DNS entries when services are destroyed. Use infrastructure-as-code to manage both resources and DNS together.

Maintain Asset Inventory

Document all subdomains and their associated cloud resources. Record service identifiers (bucket names, app names, repository names). Track ownership and lifecycle information. Regular audits identify orphaned DNS records before they become vulnerable.

Implement Approval Workflows

Require manager approval for subdomain creation. Document business justification and expected lifecycle. Set expiration dates for temporary subdomains. Automated reminders alert owners before resources are scheduled for decommissioning.

Use Automated Monitoring

Continuous automated scanning detects takeover risks within minutes of configuration changes. Alert security teams immediately when vulnerabilities are found. Historical tracking shows trends and helps identify problematic processes or teams.

Reserve Service Identifiers

For critical subdomains, reserve the service identifier even after decommissioning. Keep minimal placeholder S3 buckets, Heroku apps, or GitHub repositories to prevent claiming. This costs little but provides strong protection.

Implement DNS CAA Records

Use DNS Certification Authority Authorization (CAA) records to control which CAs can issue certificates for your domains. While this doesn't prevent takeovers directly, it limits the attacker's ability to obtain valid SSL certificates for the compromised subdomain.

Real-World Impact: Case Studies

Microsoft Azure Subdomain Takeover (2020)

Security researchers discovered multiple Microsoft subdomains vulnerable to takeover through dangling Azure DNS records. Affected domains included marketing sites and product documentation. The vulnerability persisted for months before discovery.

Lesson: Even major technology companies with substantial security teams can fall victim to subdomain takeovers when DNS hygiene isn't maintained.

UK Government Subdomain Takeover (2019)

Multiple UK government subdomains were found vulnerable to takeover via GitHub Pages. Researchers demonstrated control by hosting proof-of-concept pages. The vulnerability existed for an extended period across several departments.

Lesson: Organizations with distributed teams and multiple departments need centralized DNS management and automated monitoring to prevent gaps.

Uber Subdomain Takeover Campaign (2017)

Security researcher discovered multiple Uber subdomains vulnerable through various cloud services. Some subdomains had existed in vulnerable state for over a year. Researcher received bug bounty payouts for responsible disclosure.

Lesson: Regular security testing and bug bounty programs help identify vulnerabilities, but automated continuous monitoring provides faster detection and remediation.

Frequently Asked Questions

What is a subdomain takeover attack?
A subdomain takeover occurs when an attacker claims an external service (like AWS S3, Heroku, or GitHub Pages) that your subdomain's DNS record points to, but which you no longer control. This allows them to host content on your subdomain, appearing to come from your legitimate domain. The attack works because DNS CNAME records remain active after the target service is deleted or deprovisioned.
Which services are vulnerable to subdomain takeovers?
Common vulnerable services include AWS S3 (static hosting), Heroku (apps), GitHub Pages (repositories), Azure App Service and Cloud Services, Shopify (stores), Fastly (CDN), CloudFront (distributions), DigitalOcean App Platform, Firebase Hosting, Tumblr (blogs), Vercel, and Netlify. Any platform that allows custom domain mapping with reclaimable service identifiers is potentially vulnerable. Our system monitors 40+ platforms continuously.
How quickly can takeover vulnerabilities be detected?
Detection speed depends on your scan frequency. For continuous monitoring plans with hourly scans, new vulnerabilities are detected within 5-15 minutes of DNS propagation. Daily scan plans detect within 24 hours. Free plans with weekly scans detect within 7 days. Immediate detection requires active monitoring—vulnerabilities created between scheduled scans won't be caught until the next cycle runs.
What's the difference between subdomain takeover and DNS hijacking?
DNS hijacking involves unauthorized modification of your DNS records themselves—usually through compromised registrar accounts or DNS provider credentials. Subdomain takeover exploits existing, legitimate DNS records that point to services you no longer control. DNS hijacking requires attacking your infrastructure; subdomain takeover exploits your own misconfigurations. Both result in attacker control of your subdomain but through different attack vectors.
Can wildcard DNS records be vulnerable to takeovers?
Yes. Wildcard records (*.example.com) are vulnerable if they point to external services. The vulnerability is actually more severe because a single wildcard takeover gives attackers control over unlimited subdomains. For example, if *.example.com points to a deleted S3 bucket, an attacker claiming that bucket controls any.subdomain.example.com. Our detection specifically flags vulnerable wildcard configurations as critical priority.
What should I do immediately after a takeover is detected?
Immediate actions: First, verify the finding isn't a false positive by checking the service status directly. Second, remove the DNS record immediately—this is the fastest mitigation. Third, if you need to preserve the subdomain, recreate the service with proper security controls before updating DNS. Fourth, investigate how the vulnerability was created to prevent recurrence. Fifth, scan for similar patterns across other subdomains. Document the incident for security review and compliance reporting.
How do I prevent takeovers when decommissioning services?
Best practice is coordinated decommissioning: remove DNS records simultaneously with service deletion. Use infrastructure-as-code (Terraform, CloudFormation) to manage both resources together so they're destroyed atomically. Implement approval workflows requiring DNS verification before service deletion. Maintain an asset inventory linking subdomains to services. Schedule regular audits identifying orphaned records. For critical subdomains, reserve service identifiers even after decommissioning by maintaining minimal placeholder resources.
Are internal subdomains vulnerable to takeovers?
Internal-only subdomains (those not accessible from the public internet) have lower takeover risk but aren't immune. If internal DNS records point to external services, they're still vulnerable—an attacker can claim the service and potentially access your internal network if VPN or network access is compromised. Best practice: use separate internal DNS zones with different domains for internal-only resources, and avoid pointing internal names to external services.

Protect Against Subdomain Takeovers

Start detecting dangling DNS vulnerabilities today. Free plan includes weekly scans. Professional plan offers continuous monitoring with real-time alerts.

Start Free Security Scan