Subdomain Takeover Detection

Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.

When to Use

• Subdomain enumeration produces a large list — scan for lingering DNS records.
• Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
• A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
• The CNAME target is a service with user-registrable names.

Prerequisites

• terminal with curl, dnsx, subfinder.
• subzy or subjack installed for automated detection.
• List of alive subdomains from subdomain-enumeration.

Quick Detection