Payouts vary by target sensitivity. Patrik Hudak’s disclosed Starbucks takeover on HackerOne report #325336 paid $2,000 twice, and the industry-wide corpus of disclosed subdomain-takeover reports on HackerOne ranges from a few hundred dollars up to about $8,000 for high-impact chains that touch authentication cookies. Uber’s 2017 disclosed takeover fetched $5,000.
All questions
How do bug bounty programs pay for subdomain takeovers?
Read the full guide
What Is a Subdomain Takeover? (And Why Microsoft Had 670 of Them)
Subdomain takeover is the class of bug where a `CNAME` points to a service you already gave up — like an old S3 bucket, an expired Azure Cloud App, or a decommissioned Heroku dyno. An attacker registers the abandoned resource, and now they serve traffic from your subdomain.