OSINT · Subdomain Intelligence
Enumerate subdomains from Certificate Transparency logs, HackerTarget, AlienVault OTX, RapidDNS, CertSpotter, and Anubis-DB. Resolve full CNAME chains, detect NS delegation and SERVFAIL lame-delegation takeovers, identify wildcard zones, score each finding, and fingerprint dangling records against 100+ cloud services.
| Service | Category | CNAME Patterns | Status |
|---|
A four-phase enumeration and detection pipeline — all client-side, no proxy, no API keys required.
Queries six passive sources in parallel: crt.sh Certificate Transparency logs, HackerTarget passive DNS, AlienVault OTX threat intelligence, RapidDNS, CertSpotter CT, and Anubis-DB. Results are deduplicated and normalised before scanning begins.
Before resolving anything, Takeover queries a guaranteed-nonexistent subdomain via DoH. If it resolves, the domain has wildcard DNS — a banner warns you that results may include false positives throughout the scan.
Full CNAME chains are followed (up to 10 hops) via DNS-over-HTTPS. Each subdomain is also checked for NS delegation — dangling NS records pointing to non-existent nameservers, or delegations that return SERVFAIL (a lame delegation), indicate a separate, severe class of takeover.
After the full CNAME chain is resolved, the terminal target's A record is queried. An NXDOMAIN response on the final target — even without a fingerprint match — is a strong takeover signal and is flagged as Potential.
Each CNAME match is checked against 100+ service signatures (GitHub Pages, Heroku, S3, Azure, Netlify, Vercel, Railway, Fly.io, Zendesk, Shopify and more). An HTTP fetch attempts to confirm the dangling error page in the response body.
Every fingerprint is classified vulnerable, edge-case, or not-vulnerable, so services like CloudFront or WordPress.com don't raise false alarms. Each finding also gets a 0–100 risk score and concrete remediation guidance, exportable as Markdown, JSON, or CSV.
Choose between 5, 10, or 20 concurrent checks. All requests originate from your browser — no data passes through TheAdminStack servers. CORS restrictions apply to HTTP body verification; use the JSON/CSV export with curl to confirm findings.
Responsible Use: Takeover is designed for legitimate security research, bug bounty programmes, red team engagements, and defensive vulnerability assessment of infrastructure you own or have explicit written permission to test. Unauthorised reconnaissance of third-party domains may violate computer fraud laws in your jurisdiction. Use responsibly and in accordance with applicable laws.
A subdomain takeover happens when a DNS record (usually a CNAME) still points to a third-party service — like a deprovisioned cloud bucket, CDN, or SaaS app — that no longer claims that hostname. An attacker can re-register the service resource and serve content from your subdomain. This tool enumerates subdomains and fingerprints those dangling records against 100+ known services, each classified as vulnerable, edge-case, or not-vulnerable.
It enumerates subdomains from Certificate Transparency, HackerTarget, AlienVault OTX, RapidDNS, CertSpotter, and Anubis-DB, resolves each CNAME chain, checks NS delegation (including SERVFAIL lame delegations) and wildcard DNS, scores each finding, and compares the resulting fingerprints to a library of 100+ cloud services with documented takeover signatures.
Yes, it is free with no account needed and performs only passive enumeration and read-only DNS/HTTP fingerprinting — it does not exploit or claim any resource. Use it on domains you own or are authorized to test.