Subdomain takeover: the forgotten address an attacker can claim

The short version

How it happens, step by step

Businesses accumulate subdomains over the years. You tried Shopify for a while and pointed shop.yourbusiness.co.uk at it. You had a help centre on a support tool at help.yourbusiness.co.uk. Your old agency set up staging.yourbusiness.co.uk on a cloud server. Then you cancelled the Shopify account, switched help desks, and the agency shut down the server — but nobody updated your domain settings.

The DNS record (the signpost that says "shop.yourbusiness.co.uk lives at Shopify") is still there, pointing at a space that is now empty. This is called a dangling record. An attacker who spots it simply opens their own free account with that same provider, tells it "my site is shop.yourbusiness.co.uk", and because the signpost already points there, it works. They now control a page on your domain.

Why it is so damaging

The attacker's page is served from your real domain name, so it inherits all of your trust. It can:

• Run convincing phishing — a fake login or payment page on shop.yourbusiness.co.uk is almost impossible for your customers to spot as fake, because the address is genuinely yours.
• Steal cookies and sessions — browsers often share cookies across subdomains, so a hostile subdomain can read the cookies your main site set, including login sessions.
• Bypass your security settings — many protections (CORS, CSP, cookie rules) trust "anything on my domain". A hijacked subdomain is inside that trusted circle.
• Damage your reputation and search ranking — the page can host anything from spam to malware, all attributed to you, and Google will treat it as part of your site.

Because the attacker never touches your actual server, your hosting security, your passwords and your firewall are all irrelevant. The weakness is in a forgotten line of DNS.

How to check

On verified domains, VigilScan finds every subdomain of yours it can discover, checks where each one points, and tests whether the destination is a known service that is currently unclaimed. It only reports a takeover when the characteristic "this space is available" signature is present, so you are not chasing false alarms.

You can also review manually: log in to wherever you manage your domain (your registrar or Cloudflare), open the DNS records, and look at every CNAME record. For each one, ask: do we still use this service, and is the account still active? Anything you cannot account for deserves a closer look.

How to fix it

1. In your DNS settings, find the record for the affected subdomain.
2. If you no longer use that service, delete the record. The subdomain simply stops resolving — which is exactly what you want for something you do not use.
3. If you do still want the subdomain, re-claim the resource on the provider's side (recreate the site or app so the destination exists again and is yours), or repoint the record somewhere you control.
4. Make a habit of it: whenever you cancel an online service that had its own address on your domain, remove the DNS record the same day.

Common questions