Subdomain Takeover Risk
Overview
Subdomain takeover occurs when a DNS CNAME points to a third-party service (GitHub Pages, Heroku, S3, Netlify) whose content has been removed. An attacker can claim the now-unclaimed resource on the third-party platform and host malicious content that browsers serve under the original company's subdomain.
Remediation
- Regularly audit DNS records and remove CNAMEs for deprovisioned services
- Before deprovisioning cloud resources, remove DNS records first
- Monitor subdomain availability with tools like
can-i-take-over-xyz