Subdomain takeover happens when a DNS record (usually a CNAME) still points to a third-party service (a cloud host, CDN, or SaaS platform) that you’ve since stopped using or deleted — leaving the subdomain pointed at infrastructure someone else can now claim and control.
Why it’s dangerous
An attacker who claims the abandoned service can serve their own content on your legitimate-looking subdomain — used for phishing, malware distribution, or stealing cookies/sessions that are scoped to your parent domain.
How it happens
- A subdomain is pointed at a third-party service (e.g. a page builder, a demo environment, a cloud storage bucket)
- The underlying service/resource is later deleted or the subscription lapses
- The DNS CNAME record is never removed
- An attacker registers the same resource name on that same third-party service, "claiming" your dangling subdomain
Prevention
- Remove DNS records immediately when decommissioning any third-party service or subdomain
- Periodically audit all DNS records against what’s actually still in active use
- Use automated scanning that specifically checks for dangling CNAMEs pointing to claimable services
FAQ
Is this only a risk for large companies with lots of subdomains?
No — any site that ever used a third-party subdomain-based service (landing page tools, demo environments, old marketing tools) is at risk once that service is abandoned.