Subdomain Takeover

What It Does

Accepts either an explicit list of subdomains to probe or seeds from common names (www, mail, blog, api, dev, staging, docs, support, cdn, assets, status, etc.). For each candidate: (1) DoH CNAME lookup; (2) if CNAME target matches a takeover fingerprint, HTTPS GET the candidate; (3) body match against the service's takeover indicator text. Fingerprints currently cover 15+ services including GitHub Pages, Heroku, AWS S3, Azure Blob Storage, Fastly, Netlify, Shopify, WordPress.com, Tumblr, Readme, UserVoice, Ghost, Cargo Collective, and Unbounce. Returns per-candidate status plus an aggregated list of confirmed takeover-vulnerable subdomains.

Why It's Useful

Subdomain takeover is a low-sophistication, high-impact attack that persists for months or years after infrastructure deprovisioning. Teams forget that a blog.example.com CNAME still points to a cancelled Heroku app — until an attacker registers that app name and suddenly hosts malware under the legitimate brand. Automated detection catches these dangling CNAMEs during DNS audits rather than during an incident.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/domain/subdomain-takeover" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/domain/subdomain-takeover?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/subdomain-takeover',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.