Subdomain Takeover
highWhat is Subdomain Takeover?
Subdomain takeover occurs when a DNS record (typically a CNAME) points to an external service that has been deprovisioned, allowing an attacker to claim that service and serve content on the subdomain.
How it works
A company creates blog.example.com pointing to a GitHub Pages or Heroku app. When they stop using the service but don't remove the DNS record, an attacker can create a new account on that service and claim the subdomain.
Impact
Phishing attacks from a trusted domain, cookie theft via parent domain cookies, credential harvesting, and reputation damage.
ShieldReport's Subdomain Takeover Watchdog monitors DNS CNAMEs pointing to expired services across S3, Heroku, GitHub Pages, Shopify, Azure, and 30+ other providers.
How to fix it
Remove DNS records when deprovisioning external services. Regularly audit subdomain DNS records. Use ShieldReport's 24/7 monitoring to detect dangling records before attackers do.
Tags
Is your site vulnerable to Subdomain Takeover?
Run a free scan to find out in under 2 minutes.
Scan Now