Home / Knowledge hub / Subdomain takeover
Knowledge hub
Subdomain takeover
Claiming an abandoned cloud resource that one of your DNS names still points to.
What it means
Subdomain takeover happens when one of your DNS records, such as shop.example.com, still points to a cloud service or hosting resource that you no longer use. If a stranger can register that same resource name with the provider, your subdomain now serves their content.
It starts with housekeeping. A team closes a campaign site, deletes the hosting but leaves the DNS record behind. The record is now a pointer to nothing, often called a dangling DNS record, and nothing in your own systems complains.
Why it matters
The page appears under your real domain, so visitors and browsers treat it as yours. It can host a phishing sign-in page, spread malware, or damage your brand. In some setups, cookies set for the parent domain can be read, which opens the door to session theft.
It is also easy to miss. No alert fires, because nothing on your side changed. You may learn about it from a customer, a researcher or a search result. MITRE catalogues it as a technique for acquiring infrastructure.
How it shows up
You meet it with records pointing to cloud storage, hosting platforms, content delivery networks and software-as-a-service tools. The weak moment is after decommissioning: the service is deleted but the DNS entry stays. Old test, campaign and partner subdomains are the usual candidates. See dangling DNS and the wider attack surface.
Remove the DNS record before or when you delete the resource, keep an inventory of subdomains and what they point to, and check it regularly for records that point to unclaimed services. Avoid wide cookie scopes. Test by listing your subdomains and checking each target responds as intended.
Questions people ask
Subdomain takeover, answered
How can I tell if I am vulnerable?
List every subdomain and what each points to. Any record pointing to a service that returns a not-found or unclaimed message deserves immediate attention.
Who can take over a subdomain?
Anyone who can register the abandoned resource name with the same provider, which is often free and quick. It depends on the provider and on how it checks ownership.
What can an attacker do with it?
Serve pages under your domain, run phishing, host malicious files, and in some cases read or set cookies scoped to your parent domain.
How do we prevent it?
Delete DNS records as part of shutting a service down, keep an inventory, and monitor for dangling records. Some providers also offer domain verification that blocks claims.
Is it the same as domain hijacking?
No. Domain hijacking takes control of the whole domain. Subdomain takeover captures one name through a forgotten pointer.
Sources
Where this comes from
Related
Terms that sit next to this one
Dangling DNS
A DNS record pointing at something you no longer own or run.
Domain hijacking
Someone taking control of your domain name, and so your site and email.
Asset inventory
A current list of the systems, apps and data you are responsible for.
Attack surface
Everything about your application an outsider can touch.
Cookie scope
The domain and path settings that decide which sites and pages receive a cookie.
Does an old name still point out?
Forgotten subdomains are part of your attack surface, and we check what each one serves and whether it can be claimed. Findings carry the evidence. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.