How Subdomain Takeovers Happen

A subdomain takeover occurs when an attacker gains control of a subdomain because the DNS record points to a resource that no longer exists.

Common Causes

• Deleted GitHub Pages, Heroku, or AWS S3 buckets still referenced in DNS.
• Expired cloud services with lingering CNAME records.
• Decommissioned third-party integrations.

Impact

Attackers can host phishing pages, steal cookies, or bypass CSP and CORS protections on the parent domain. The damage is often high because users trust subdomains.

Prevention

• Continuously monitor all DNS records.
• Remove CNAMEs before deleting the target resource.
• Use automated tools like ShadowSurface to detect dangling records.