Subdomain Takeover Detection
A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.
How it uses the graph
Traverses the DNS layer of the graph, in 3 steps:
How it walks the graph3 steps
01Subdomain estate
Enumerating the subdomain estate…
DNS
02Dangling CNAMEs
Flagging CNAMEs whose target no longer resolves…
DNS
03CNAME delegation chains
CNAME delegation chains…
DNS
Why each step runs
- 01Subdomain estate. The estate is the candidate set for dangling references.
- 02Dangling CNAMEs. A CNAME to a non-resolving target is the takeover signature (prod-ahead ALIAS_OF layer).
- 03CNAME delegation chains. Traces each subdomain's full CNAME delegation chain (up to 5 hops) and flags chains whose final target no longer resolves to an IP — the dangling endpoint a takeover would hijack.