What is a dangling DNS record, and does subzy catch it?

A dangling record is a subdomain that still points, usually by CNAME, at a cloud or SaaS resource that has been deleted. Anyone who re-registers that resource controls the subdomain. subzy catches the dangling records whose service answers with a recognizable claimable fingerprint, such as a removed S3 bucket, GitHub Pages site, or Heroku app.

How often should I run subdomain takeover scans?

Run subzy whenever your subdomain inventory changes and on a fixed cadence between changes; weekly is a common baseline. Dangling records appear the moment a team deletes a bucket or app but leaves the DNS entry, so a scheduled Trickest workflow that re-runs discovery and subzy will catch new exposure without manual effort.

Can subzy scan thousands of subdomains at once?

Yes. Pass a file with -targets, raise -concurrency above the default 10 for a wide scope, and set -hide_fails so the output lists only takeover candidates. -timeout controls how long each request waits before subzy moves on.

Does subzy detect DNS zone or nameserver takeover?

No. subzy works on HTTP and HTTPS responses, so it finds service and CNAME takeovers, not dangling nameserver delegations or zone-level issues. For a dangling NS record you need a DNS-focused check; subzy covers the response-fingerprint class that can-i-take-over-xyz tracks.

What services does the can-i-take-over-xyz fingerprint set cover?

The community-maintained can-i-take-over-xyz project lists providers known to be vulnerable to takeover and the response signature each one returns when a resource is unclaimed. subzy ships these fingerprints and matches them, so its coverage tracks the project: common entries include AWS S3, GitHub Pages, Heroku, Shopify, and Fastly.

How do I fix a subdomain takeover subzy reports?

Remove the dangling DNS record or reclaim the resource it points at. If the subdomain no longer needs to exist, delete the CNAME; if it does, re-create the target service under your account so the name resolves to something you control. Re-run subzy afterward to confirm the host no longer matches a takeover fingerprint.

Updated Jul 14, 2026

Vulnerabilities

Detect subdomain takeovers from response fingerprints

Subdomain takeover tool driven by response fingerprints from can-i-take-over-xyz.

Confirm takeovers across a discovered surface Hunt dangling cloud and SaaS records Keep takeover scans focused

overview

What subzy does

subzy reads a list of subdomains and tests each one for a takeover condition. It requests the host, reads the response, and matches it against the fingerprint set maintained in the can-i-take-over-xyz project. When a subdomain points at a deprovisioned cloud service that still answers with a claimable error page, subzy flags it as vulnerable so you can register the dangling resource before an attacker does.

The check is response-driven, so it stays fast and avoids the false positives that come from CNAME inspection alone. You can scan a single host, a comma-separated set, or a file of thousands of subdomains, and tune concurrency, request timeout, and HTTPS handling to match the scope. Hiding failed results keeps the output focused on the hosts worth acting on.

On Trickest, subzy is a Vulnerabilities-category node that takes a subdomain list and writes a file and a folder of results. Place it after subdomain enumeration: discovery produces the candidate names, subzy confirms which ones resolve to claimable services, and the findings land as a queryable output you can triage or alert on.

source github.com/LukaSikic/subzy

use cases

Where subzy fits

Confirm takeovers across a discovered surface

Feed a full subdomain list into subzy so every host is tested against the live fingerprint set, surfacing only the names that point at claimable, dangling services.

Hunt dangling cloud and SaaS records

Catch subdomains that still CNAME to a deleted S3 bucket, GitHub Pages site, or Heroku app, the exact conditions an attacker uses to hijack a domain.

Keep takeover scans focused

Set -hide_fails to drop non-vulnerable hosts and raise -concurrency so a wide scope finishes quickly with output that only lists actionable findings.

Re-scan on a schedule to catch new exposure

Wire discovery plus subzy into a scheduled Trickest workflow so newly created subdomains are tested for takeover as they appear, without a manual pass.

reference

subzy inputs and flags

7 inputs

Name	Type	Flag	Description
target	STRING	-target	Single or multiple subdomains separated by comma.
targets	FILE	-targets	File of subdomains to scan, the usual pipeline input.
concurrency	STRING	-concurrency	Number of concurrent checks (default 10).
timeout	STRING	-timeout	Request timeout in seconds (default 10).
hide-fails	BOOLEAN	-hide_fails	Do not display non-vulnerable results.
force-https	BOOLEAN	-https	Force HTTPS when the target has no protocol defined.
dont-verify-ssl	BOOLEAN	-verify_ssl	Skip sites with insecure SSL instead of returning an HTTP error.

Showing key inputs. subzy exposes 7 inputs in total.

example

Run subzy

subzy · command

# scan a subdomain list, hide non-vulnerable hosts, raise concurrencysubzy -targets subdomains.txt -hide_fails -concurrency 50 -timeout 15

sample output

[ VULNERABLE - GitHub Pages ]  https://assets.example.com[ VULNERABLE - Amazon S3 ]     https://cdn.example.com[ NOT VULNERABLE ]             https://api.example.com[ NOT VULNERABLE ]             https://app.example.com[ NOT VULNERABLE ]             https://staging.example.com[ HTTP ERROR ]                 https://legacy.example.comResults  vulnerable: 2  not vulnerable: 3  errors: 1

guidance

Choosing subzy

Reach for subzy when you have a subdomain list and want to know which hosts are takeover candidates. It checks against the can-i-take-over-xyz fingerprints, so it complements a generic DNS tool by confirming the response actually looks claimable. Pair it with subfinder upstream for the names and tko-subs as a second opinion.

tko-subs

Also detects and can take over dead DNS records. Uses a CMS providers CSV rather than the can-i-take-over-xyz fingerprint set.

subfinder

Finds the subdomains in the first place. Run it before subzy, not instead of it.

nuclei

Has takeover templates among thousands of other checks. subzy is purpose-built and faster for this one job.

faq

subzy questions

It requests the host, reads the response, and matches it against the fingerprint set from the can-i-take-over-xyz project. When the error page indicates a claimable, deprovisioned service, subzy marks the host vulnerable. Because the check reads the live response rather than the CNAME alone, it cuts the false positives you get from DNS inspection by itself.

Run subzy yourself

A domain feeds subfinder, which enumerates subdomains and passes them to subzy, which flags the takeover candidates as a queryable output.

Run subzy in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

STRING

-target

Single or multiple subdomains separated by comma.

targets

FILE

-targets

File of subdomains to scan, the usual pipeline input.

concurrency

STRING

-concurrency

Number of concurrent checks (default 10).

timeout

STRING

-timeout

Request timeout in seconds (default 10).

hide-fails

BOOLEAN

-hide_fails

Do not display non-vulnerable results.

force-https

BOOLEAN

-https

Force HTTPS when the target has no protocol defined.

dont-verify-ssl

BOOLEAN

-verify_ssl

Skip sites with insecure SSL instead of returning an HTTP error.

[ VULNERABLE - GitHub Pages ] https://assets.example.com[ VULNERABLE - Amazon S3 ] https://cdn.example.com[ NOT VULNERABLE ] https://api.example.com[ NOT VULNERABLE ] https://app.example.com[ NOT VULNERABLE ] https://staging.example.com[ HTTP ERROR ] https://legacy.example.comResults vulnerable: 2 not vulnerable: 3 errors: 1

Detect subdomain takeovers from response fingerprints

What subzy does

Where subzy fits

Confirm takeovers across a discovered surface

Hunt dangling cloud and SaaS records

Keep takeover scans focused

Re-scan on a schedule to catch new exposure

subzy inputs and flags

Run subzy

Choosing subzy

tko-subs

subfinder

nuclei

subzy questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run subzy yourself

Detect subdomain takeovers from response fingerprints

What subzy does

Where subzy fits

Confirm takeovers across a discovered surface

Hunt dangling cloud and SaaS records

Keep takeover scans focused

Re-scan on a schedule to catch new exposure

subzy inputs and flags

Run subzy

Choosing subzy

tko-subs

subfinder

nuclei

subzy questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run subzy yourself