Subdomain Takeover Diagnostic Tool
Scan client subdomains for orphaned CNAME records pointing to decommissioned AWS S3, GitHub Pages, Vercel, or Fly.io buckets.
Purpose of the Test
Identifies dangling DNS CNAME records pointing to decommissioned or unclaimed third-party cloud hosting services (AWS S3, GitHub Pages, Vercel, Heroku, Pantheon) that attackers can claim to hijack the subdomain.
How It Works
Performs a recursive CNAME lookup on the submitted subdomain. If pointing to known cloud hosting providers, the engine probes the target over HTTP/HTTPS and evaluates response bodies against canonical abandonment signatures (e.g. NoSuchBucket, 404: NOT_FOUND).
Limitations & Specifics
This free diagnostic tests a single, specific subdomain entered by the user (e.g. staging.client.com). It does not recursively enumerate private internal subdomains or bypass Cloudflare/WAF origin IP cloaking.
How to Interpret Your Results & Next Steps for Agencies
✓ Status: SECURE
What it means: The subdomain either points directly to an active web server or resolves to an actively claimed cloud deployment with no orphan signatures detected.
Next step: Retain active monitoring to ensure the record is cleaned up whenever the underlying project or deployment is eventually retired.
✗ Status: VULNERABLE (Critical Takeover Risk)
What it means: A dangling DNS pointer was detected. A developer deleted an S3 bucket, Vercel project, or GitHub repo, but left the DNS CNAME in place. An attacker can create an account with that cloud provider, claim that exact name, and serve arbitrary phishing or malware on your client’s domain.
Immediate remediation: Log in to the domain's DNS manager (Cloudflare, Route53, GoDaddy) and immediately delete the orphaned CNAME record, or re-claim the destination resource under your agency's account.