Subdomain takeover is a class of vulnerability where a CNAME (or ALIAS) record points to a third-party service that no longer exists — typically an abandoned S3 bucket, decommissioned Heroku dyno, expired Azure Cloud App, or a deleted GitHub Pages site. An attacker registers the abandoned resource and now serves content from your subdomain.
Real Example
Microsoft famously had 670 vulnerable subdomains in 2020, exposed via a Vullnerability discovered by Michel Gaschet. Attackers could serve phishing pages from *.microsoft.com, *.azure.com, and similar high-trust names.
Detection
Common patterns to scan for:
- CNAME targets that return 404 / NoSuchBucket / no-such-app
- SSL cert with a “domain does not exist” error
- Third-party service subdomain patterns (
*.herokuapp.com,*.s3.amazonaws.com,*.azurewebsites.net)
Fix
Remove the DNS record before decommissioning the underlying service. Not after. Prevention is a one-line rule: “never delete a service until you’ve deleted the DNS record pointing to it.”
Why It’s Devastating
Attacker-served content inherits your subdomain’s trust: SSL cert, browser session cookies (if scoped .example.com), and brand credibility. Perfect setup for credential harvesting.
Related
Read what a subdomain takeover is in depth, check the dangling CNAME glossary entry, and the CNAME record entry.