Understanding Subdomain Takeover and How to Prevent It

What is a Subdomain Takeover?

A subdomain takeover occurs when an attacker gains control over a subdomain of a target organization (e.g., support.yourcompany.com).

This usually happens due to dangling DNS records.

The Anatomy of the Attack

1. A company creates a CNAME record pointing blog.company.com to a third-party service, like a GitHub Pages site (company.github.io).
2. Time passes, and the company decides to stop using GitHub Pages. They delete the repository.
3. Crucially, they forget to delete the DNS record.
4. The DNS record still points to company.github.io.
5. An attacker notices this, creates a new repository on GitHub, and claims the company.github.io name.
6. The attacker now controls the content displayed at blog.company.com.

The Impact

Subdomain takeovers are devastating for brand reputation. Attackers can use the hijacked subdomain to host phishing pages, steal cookies, bypass CORS policies, or distribute malware—all under the guise of your legitimate domain.

Prevention

1. DNS Hygiene: Regularly audit your DNS records. Whenever you decommission a third-party service, delete the associated DNS records immediately.
2. Automated Monitoring: Use an attack surface management tool like Exarlo to continuously monitor your subdomains for dangling CNAME records and alert you before an attacker claims them.