Subdomain Takeover Checker
Detect dangling CNAME records pointing to unclaimed third-party services — a common way attackers hijack subdomains.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
A dangling CNAME happens when a subdomain still points to a third-party service (GitHub Pages, Heroku, an S3 bucket) that was deleted or never claimed. Anyone can then register that same resource on the third-party platform and serve their own content under your subdomain.
This is a quiet, easy-to-miss risk left over from decommissioned projects — this tool checks the CNAME target against known vulnerable service fingerprints to flag it before someone else finds it first.
Frequently asked questions
How urgent is fixing a dangling subdomain?
Treat it as high priority — these are actively scanned for by attackers, and a successful takeover lets someone serve content under your own trusted domain, often complete with a valid SSL certificate.
The check came back clean — does that mean the subdomain is safe forever?
It reflects the subdomain's status at the moment you checked. If the underlying cloud resource is deleted later without also removing the DNS record, it becomes vulnerable at that point — periodic re-checking matters for subdomains tied to services that get deprovisioned.
Related tools