Your main website might be locked down, but what about the subdomains you stopped using? A subdomain takeover happens when a subdomain — like blog.example.com or old.example.com — still points to a third-party service you no longer control, such as a deleted hosting account, an expired trial, or an abandoned cloud bucket. If an attacker claims that abandoned service, they can take over your subdomain and serve their own content under your trusted domain name.
Why does this matter? Visitors trust your domain. A taken-over subdomain can host phishing pages, spread malware, or steal login credentials, all while looking like it belongs to you. Search engines may even penalise your main site if the subdomain starts serving spam. Worse, because the subdomain is forgotten, the attack can run for months before anyone notices.
Finding these risks is simpler than it sounds. Start by listing every subdomain you own — your DNS records and your hosting control panel are the best sources. For each one, check where it points and whether that destination still belongs to you. Look out for subdomains pointing to services you cancelled, trial accounts that expired, or cloud storage that was deleted. Anything pointing nowhere, or to a service you no longer recognise, is a red flag.
Fixing the problem is straightforward: remove DNS records for subdomains you no longer use, and reclaim or delete the dangling service before anyone else does. If a subdomain is still needed, make sure it is actively maintained, updated, and covered by the same security checks as your main site.
Make subdomain checks part of your regular routine — a quick review every few months is enough to catch most problems early. A fast way to start is to run a scan of your site at https://vulnerabilitytools.com/ and review what it finds, then follow up on any forgotten subdomains it brings to light.
Your domain's reputation covers every subdomain under it — do not leave one unlocked.
Top comments (0)