Glossary
What Is a Subdomain Takeover?
Published Last updated
A subdomain takeover is an attacker claiming the abandoned target of a DNS record you still publish. They serve content on your hostname, with your name on it, without touching your DNS.
Organisations point subdomains at third-party services constantly: a status page, a documentation host, a marketing tool, a storage bucket. When the service is decommissioned the DNS record usually stays. If the platform lets anyone re-claim the name the record points at, an attacker claims it and starts answering on your hostname.
What makes it worse than a defacement is that the hostname is genuinely yours. It passes a visual check, it often inherits a wildcard certificate, and it can be trusted by cookie scopes, CORS policies and SSO redirect allowlists that were written around your domain. Phishing hosted on your own subdomain is phishing your filters were never built to stop.
The condition is found, not flagged: enumerate the subdomains under a domain through CHILD_OF, follow ALIAS_OF to whatever each one aliases, and look for a target with no resolution behind it. WhisperGraph holds all three edges over a hostname corpus in the billions, so the sweep covers the subdomains you forgot about as readily as the ones you track.
See it in practice
Run it live: Find subdomain takeover exposure.
Workflows that use this
Runnable workflows where this concept does the work.
Subdomain Takeover Detection
A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.
