SUBDOMAIN TAKEOVER
A subdomain pointing at a service you cancelled is not untidy. With several providers it is claimable, and whoever claims it controls what is served from your address, on your domain, usually with a valid certificate.
Most writing on this is either a vulnerability disclosure or a tool README. Very little explains how these appear in ordinary businesses, which is by cancelling a trial and forgetting the DNS record.
This guide covers the mechanism, how to find every instance on a domain you own, what each provider does differently, and how to stop new ones appearing.
In this guide you will learn:
The two conditions, and why only one of them is a problem.
Trials, campaigns, redesigns, and the action nobody takes afterwards.
Certificate transparency, and why guessing names is unnecessary.
The CNAME is not enough. What the second signal is.
Content, certificates, cookies, and why phishing here is convincing.
Which release names, which verify domains, which block reclaiming.
One DNS deletion, and the habit that stops the next one.
Doing this once settles nothing. What ongoing looks like.
Chapter 1
The two conditions, and why only one of them is a problem.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 2
Trials, campaigns, redesigns, and the action nobody takes afterwards.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 3
Certificate transparency, and why guessing names is unnecessary.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 4
The CNAME is not enough. What the second signal is.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 5
Content, certificates, cookies, and why phishing here is convincing.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 6
Which release names, which verify domains, which block reclaiming.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 7
One DNS deletion, and the habit that stops the next one.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 8
Doing this once settles nothing. What ongoing looks like.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Check yours
Everything in this guide, checked on your domain in about ten seconds. Free, no account, every finding shown in full.