What is Subdomain Takeover? A Guide for UK Website Owners

What is subdomain takeover? A guide for UK website owners

Subdomain takeover is a security vulnerability that allows an attacker to take control of a subdomain of your website — for example, shop.yourcompany.com or app.yourcompany.com — and serve content from it as if it were you.

How it happens

Subdomain takeover occurs when a DNS record for a subdomain points to a third-party service that is no longer active or configured.

Here is the typical sequence. Your company sets up a subdomain like staging.yourcompany.com and points it to a cloud hosting service, a GitHub Pages site, or a similar platform. At some point the account or project on that platform is deleted or expires. The DNS record pointing to it is not removed. The subdomain now points to a hosting location that is unclaimed.

An attacker discovers this orphaned DNS record, claims the underlying hosting account or creates a project at the same location, and suddenly controls what is served at staging.yourcompany.com.

Why it matters

From the visitor's perspective, the content at staging.yourcompany.com appears to come from your company. Your company name is in the URL. Any SSL certificate obtained by the attacker will show your domain.

Attackers use subdomain takeover to: host phishing pages under your domain to steal credentials from your customers, conduct malware distribution campaigns using your domain's reputation, bypass content security policies that trust your subdomains, capture session cookies that are set across your entire domain.

Which services are commonly affected

Subdomain takeover vulnerabilities most commonly arise from orphaned DNS records pointing to: GitHub Pages, Heroku, AWS S3 buckets, Azure services, Shopify stores, Fastly, and various other cloud services that allow user-created projects at specific URL patterns.

How to find and fix it

Audit your DNS records and identify every subdomain. For each subdomain, verify that the underlying service still exists and is actively controlled by your organisation. Remove DNS records for services you no longer use.

Does Yrzo AI test for subdomain takeover?

Yes. Yrzo AI enumerates your subdomains and checks each one for signs of subdomain takeover — including responses from common hosting providers that indicate an unclaimed project. Starting at £399 for a full report.