Public research repeatedly names AWS S3, Azure Cloud Apps / Azure Websites / Azure Traffic Manager, Heroku, GitHub Pages, Elastic Beanstalk, Shopify, and Fastly as the most-abused surfaces. The pattern is the same everywhere: any service that lets you claim a hostname on a shared domain (*.s3.amazonaws.com, *.azurewebsites.net, *.herokuapp.com) is a candidate whenever the customer forgets to delete their DNS after they leave the service.
All questions
Which cloud services are most vulnerable to subdomain takeover?
Read the full guide
What Is a Subdomain Takeover? (And Why Microsoft Had 670 of Them)
Subdomain takeover is the class of bug where a `CNAME` points to a service you already gave up — like an old S3 bucket, an expired Azure Cloud App, or a decommissioned Heroku dyno. An attacker registers the abandoned resource, and now they serve traffic from your subdomain.