All questions
Q & A Security · September 3, 2026

What is a subdomain takeover in one sentence?

A subdomain takeover happens when your DNS still points a subdomain at a third-party service (S3 bucket, Azure Cloud App, Heroku dyno, GitHub Pages site) that you no longer own — allowing an attacker to re-register the abandoned resource and serve their own content from your subdomain.

Read the full guide
What Is a Subdomain Takeover? (And Why Microsoft Had 670 of Them)
Subdomain takeover is the class of bug where a `CNAME` points to a service you already gave up — like an old S3 bucket, an expired Azure Cloud App, or a decommissioned Heroku dyno. An attacker registers the abandoned resource, and now they serve traffic from your subdomain.
Related questions
How do bug bounty programs pay for subdomain takeovers? How does DomainScan detect subdomain takeover risk? How much damage can a subdomain takeover cause? What is a dangling CNAME? Which cloud services are most vulnerable to subdomain takeover?