Subdomain takeover: the CNAME pointing to nothing

Many subdomains point (via CNAME) to external services: shop.company.com -> company.myshopify.com. If the service is decommissioned but the CNAME remains, that target is "dangling".

The attack

The attacker registers the freed resource at the provider (the same Shopify/GitHub Pages/S3 name) and now controls the content served on shop.company.com. The domain is yours, but the page is theirs: credible phishing, cookie theft (if the cookie is set on the parent domain), CORS/SSO bypass.

dig shop.company.com   # CNAME to a target replying "NoSuchBucket"
# -> claimable

Defence

Remove DNS records when decommissioning a service (order: DNS first, then the service — not the reverse). Continuous inventory of subdomains and their targets, automated scanning (subjack, nuclei) for dangling CNAMEs. Avoid cookies set on shared parent domains.