Subdomain takeover checker
That old marketing site on a since-deleted Heroku app, the docs subdomain pointing at a gone S3 bucket — a leftover DNS record aimed at an unclaimed hosting target lets anyone re-register it and serve their content from your domain. We discover your subdomains via Certificate Transparency, then flag the dangling ones.
Scan a domain
Server-side Certificate Transparency + DNS lookup, with an SSRF-guarded fingerprint probe only for subdomains that point at a known hosting service. Takes 10–30s.
How it works: We pull your subdomains from crt.sh Certificate Transparency logs (public records of every TLS certificate issued for your domain), then resolve each one server-side. A subdomain is at risk when its CNAME points somewhere that no longer answers:
- Dangling CNAME— the target doesn't resolve at all (NXDOMAIN). Whoever registers that name inherits your subdomain.
- Unclaimed hosting target— the CNAME points at a service (Heroku, Netlify, S3, GitHub Pages, Azure, and more) whose page returns that service's "this resource doesn't exist" fingerprint.
On honesty: we grade every finding by confidence — CONFIRMED (the live page matched a known takeover fingerprint), LIKELY (a CNAME to an NXDOMAIN target), and UNVERIFIED (points at a takeover-prone service, but we couldn't confirm). We never call something vulnerable without the confirmed tier, and we only check the subdomains Certificate Transparency reveals — that is not an exhaustive inventory of your DNS.
Want this run continuously with an alert the moment a subdomain starts dangling? That's what continuous monitoring is for.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
HSTS preload checker
Grade against Chrome's preload list