Infra Audit5 min readUpdated November 4, 2026

Your Forgotten Subdomain Is Someone Else's Phishing Page

Delete the service, keep the DNS record, and anyone can register the target and serve content on your domain. One record, full brand trust.

Enumerate every CNAME, resolve each, and check for provider-specific responses like NXDOMAIN or NoSuchBucket. A dangling record to S3, CloudFront, Heroku or GitHub Pages means anyone can claim your subdomain and serve content under your name.

A team deploys staging on Heroku, creates staging.company.com pointing at the app, then decommissions the app. The DNS record stays. Heroku frees the app name. An attacker registers the same app name on Heroku, and now staging.company.com serves their content, with a certificate Heroku issues for your domain.

See How We Work

In This Guide

The mechanism

A team deploys staging on Heroku, creates staging.company.com pointing at the app, then decommissions the app. The DNS record stays. Heroku frees the app name. An attacker registers the same app name on Heroku, and now staging.company.com serves their content, with a certificate Heroku issues for your domain.
A team deploys staging on Heroku, creates staging.company.com pointing at the app, then decommissions the app. The DNS record stays. Heroku frees the app name. An attacker registers the same app name on Heroku, and now staging.company.com serves their content, with a certificate Heroku issues for your domain. The same pattern works for S3 (NoSuchBucket), CloudFront, Azure, GitHub Pages and a dozen more providers.

The check

crt.sh returns every certificate issued for the domain, which surfaces subdomains nobody remembers. Resolve each: a CNAME to a known provider is the candidate. One status-code request to the target: the provider's not-found fingerprint confirms the record is dangling. The audit skill keeps the fingerprint list and reports each claimable record as a confirmed finding.
crt.sh returns every certificate issued for the domain, which surfaces subdomains nobody remembers. Resolve each: a CNAME to a known provider is the candidate. One status-code request to the target: the provider's not-found fingerprint confirms the record is dangling. The audit skill keeps the fingerprint list and reports each claimable record as a confirmed finding.

If it stays

The subdomain is a phishing page waiting for an attacker to claim it, and the claim is free. Every customer who receives a link to your domain trusts it by default.
The subdomain is a phishing page waiting for an attacker to claim it, and the claim is free. Every customer who receives a link to your domain trusts it by default. The fix is one DNS deletion, but the record usually lives in infrastructure code nobody owns, which is why the audit also asks who manages the zone.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

crt.sh lists every certificate ever issued for your domain: that is your subdomain map.

2

S3 returns NoSuchBucket, Azure returns 404 with a specific body, GitHub Pages returns 404 with its footer. Each is a fingerprint.

3

The fix is one DNS deletion. The risk is that the record is in Terraform nobody owns anymore.

4

Check after every service decommission. The record outlives the service by default.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

What is a dangling CNAME and subdomain takeover?

A DNS record pointing to a service that was deleted. Anyone can register that service name and serve content on your subdomain, with your brand and your cookies. Attackers use it for phishing that passes every trust check, because the page really is on your domain.

How do I check for subdomain takeover?

Enumerate subdomains from crt.sh and DNS, resolve every CNAME, and check the target's response. S3 answers NoSuchBucket, Heroku answers no-such-app, GitHub Pages answers with a 404 page. Each fingerprint means the record is claimable. The fix is deleting the DNS record.

Why is subdomain takeover dangerous?

The attacker serves content on your actual domain, with a valid TLS certificate for it. Phishing from your domain bypasses brand trust, email filters and user suspicion. It can also set cookies on your parent domain, which turns takeover into session theft.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works