Subdomain takeover is a vulnerability where an attacker gains control of a subdomain of your domain — not by hacking your DNS, but by exploiting a DNS record that points to a service you've stopped using.

The result: a page at something.yourdomain.com, apparently part of your site, controlled by someone else.

How it happens

  1. You set up a subdomain pointing to a third-party service — blog.yourdomain.com points to Netlify, or status.yourdomain.com points to Statuspage.
  2. You stop using that service and delete the account — but forget to remove the DNS record.
  3. The DNS record still exists, pointing to a "resource not found" state on the platform.
  4. An attacker notices the dangling record and registers a new account using the same URL.
  5. The attacker now controls content served at blog.yourdomain.com.

Why this is serious

A subdomain inherits trust from your domain. Visitors see no warning that it's controlled by someone else. This enables:

  • Phishing — a convincing login page at a trusted-looking URL
  • Cookie theft — same-site cookies from your main domain may be readable from subdomains
  • Reputation damage — malware served under your domain name

Subdomain takeovers have been documented across GitHub Pages, Netlify, Heroku, Fastly, AWS S3, Azure, Shopify, and many others.

How to prevent it

  • Audit DNS regularly — review all CNAME records, especially those pointing to third-party services
  • Before deprovisioning a service, remove the DNS record first, then shut down the service
  • Monitor your attack surface — threatprobe.app's Full report includes active subdomain discovery

Check your subdomain exposure →