Question 1

What is a subdomain takeover?

Accepted Answer

A subdomain takeover occurs when a DNS record (typically a CNAME) points to an external cloud service (such as AWS S3, GitHub Pages, or Heroku) that has been deleted or unclaimed. An attacker can register the abandoned resource on the cloud provider and take complete control of the subdomain.

Question 2

How does SubdomainWatch detect dangling CNAMEs?

Accepted Answer

SubdomainWatch recursively traverses CNAME chains up to 8 hops, matches the destination against 42 verified cloud provider signatures, and conducts bounded, non-destructive HTTP slice probes to verify whether the target resource is unallocated.

Question 3

Is this takeover scan safe and non-destructive?

Accepted Answer

Yes. The scanner performs passive reconnaissance adhering to UK Computer Misuse Act 1990 and US CFAA standards. It reads only public DNS records and the first 16KB of HTTP response headers/body, without provisioning or modifying any cloud assets.