> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # "Can I take over XYZ?" β€” a list of services and how to claim (sub)domains with dangling DNS records - URL: https://darkwebinformer.com/can-i-take-over-xyz-a-list-of-services-and-how-to-claim-sub-domains-with-dangling-dns-records/ - Published: 2024-08-26T21:26:40.000Z - Updated: 2025-09-04T22:27:12.000Z - Author: Dark Web Informer - Tags: OSINT, Tools GitHub: Last Commit: August 24th, 2024 --- ## Disclaimer ⚠️ [](https://github.com/EdOverflow/can-i-take-over-xyz#disclaimer-warning) **The authors of this document take no responsibility for correctness. This project is merely here to help guide security researchers towards determining whether something is vulnerable or not, but does not guarantee accuracy. This project heavily relies on contributions from the public; therefore, proving that something is vulnerable is the security researcher and bug bounty program's sole discretion.** **Furthermore, it is important to clarify that this project does not aim to identify or disclose bypasses to security measures implemented by various services. Instead, it is expected that such bypasses be reported directly to the affected service for appropriate action.** **Finally, it is worth noting that some bug bounty programs may accept dangling DNS record reports without requiring proof of compromise.** ## What is a subdomain takeover? [](https://github.com/EdOverflow/can-i-take-over-xyz#what-is-a-subdomain-takeover) > Subdomain takeover vulnerabilities occur when a subdomain (subdomain.example.com) is pointing to a service (e.g. GitHub pages, Heroku, etc.) that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain. For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com. You can read up more about subdomain takeovers here: - - - ## Safely demonstrating a subdomain takeover [](https://github.com/EdOverflow/can-i-take-over-xyz#safely-demonstrating-a-subdomain-takeover) Based on personal experience, claiming the subdomain discreetly and serving a harmless file on a hidden page is usually enough to demonstrate the security vulnerability. Do not serve content on the index page. A good proof of concept could consist of an HTML comment served via a random path: ``` $ cat aelfjj1or81uegj9ea8z31zro.html ``` Please be advised that this depends on what bug bounty program you are targeting. When in doubt, please refer to the bug bounty program's security policy and/or request clarifications from the team behind the program. ## How to use this project [](https://github.com/EdOverflow/can-i-take-over-xyz#how-to-use-this-project) I recommend searching for the name of the service you are targeting in the issues tab. That way you can see the on-going discussion and more detailed steps on how to claim the subdomain you are after. ## How to contribute [](https://github.com/EdOverflow/can-i-take-over-xyz#how-to-contribute) You can submit new services here: . A list of services that can be checked (although check for duplicates against this list first) can be found here: [#26](https://github.com/EdOverflow/can-i-take-over-xyz/issues/26). # All entries [](https://github.com/EdOverflow/can-i-take-over-xyz#all-entries) Note: `fingerprints.json` is automatically updated based on the content of this table. Column header definitions: - `Engine`: Name of service - `Status`: Whether the service is vulnerable - `Verified by CI/CD`: Whether automated fingerprint check is currently passing - `Domains`: Comma-separate domains (used for fingerprint auto-verification) - `Fingerprint`: Regex indicating vulnerable page (or `NXDOMAIN`, indicating non-existent DNS record) - `Discussion`: Link to issue on this repo for discussion - `Documentation`: Link to official documentation | Engine | Status | Verified by CI/CD | Domains | Fingerprint | Discussion | Documentation | | ----------------------- | -------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | AWS/Elastic Beanstalk | Vulnerable | 🟩 | elasticbeanstalk.com | NXDOMAIN | [Issue #194](https://github.com/EdOverflow/can-i-take-over-xyz/issues/194) | | | AWS/Load Balancer (ELB) | Not vulnerable | πŸŸ₯ | elb.amazonaws.com | NXDOMAIN | [Issue #137](https://github.com/EdOverflow/can-i-take-over-xyz/issues/137) | | | AWS/S3 | Vulnerable | 🟩 | s3.amazonaws.com | The specified bucket does not exist | [Issue #36](https://github.com/EdOverflow/can-i-take-over-xyz/issues/36) | | | Acquia | Not vulnerable | πŸŸ₯ | | Web Site Not Found | [Issue #103](https://github.com/EdOverflow/can-i-take-over-xyz/issues/103) | | | Agile CRM | Vulnerable | πŸŸ₯ | agilecrm.com | Sorry, this page is no longer available. | [Issue #145](https://github.com/EdOverflow/can-i-take-over-xyz/issues/145) | | | Airee.ru | Vulnerable | 🟩 | airee.ru | Ошибка 402\. БСрвис Айри.Ρ€Ρ„ Π½Π΅ ΠΎΠΏΠ»Π°Ρ‡Π΅Π½ | [Issue #104](https://github.com/EdOverflow/can-i-take-over-xyz/issues/104) | | | Akamai | Not vulnerable | πŸŸ₯ | | | [Issue #13](https://github.com/EdOverflow/can-i-take-over-xyz/issues/13) | | | Anima | Vulnerable | 🟩 | animaapp.io | The page you were looking for does not exist. | [Issue #126](https://github.com/EdOverflow/can-i-take-over-xyz/issues/126) | [Anima Documentation](https://docs.animaapp.com/v1/launchpad/08-custom-domain.html) | | Bitbucket | Vulnerable | 🟩 | bitbucket.io | Repository not found | [Issue #97](https://github.com/EdOverflow/can-i-take-over-xyz/issues/97) | | | Campaign Monitor | Vulnerable | πŸŸ₯ | | Trying to access your account? | [Issue #275](https://github.com/EdOverflow/can-i-take-over-xyz/issues/275) | [Support Page](https://help.campaignmonitor.com/custom-domain-names) | | Canny | Vulnerable | πŸŸ₯ | | Company Not Found There is no such company. Did you enter the right URL? | [Issue #114](https://github.com/EdOverflow/can-i-take-over-xyz/issues/114) | | | Cargo Collective | Vulnerable | πŸŸ₯ | | 404 Not Found | [Issue #152](https://github.com/EdOverflow/can-i-take-over-xyz/issues/152) | [Cargo Support Page](https://support.2.cargocollective.com/Using-a-Third-Party-Domain) | | Cloudfront | Not vulnerable | πŸŸ₯ | | ViewerCertificateException | [Issue #29](https://github.com/EdOverflow/can-i-take-over-xyz/issues/29) | [Domain Security on Amazon CloudFront](https://aws.amazon.com/blogs/networking-and-content-delivery/continually-enhancing-domain-security-on-amazon-cloudfront/) | | Desk | Not vulnerable | πŸŸ₯ | | Please try again or try Desk.com free for 14 days. | [Issue #9](https://github.com/EdOverflow/can-i-take-over-xyz/issues/9) | | | Digital Ocean | Vulnerable | πŸŸ₯ | | Domain uses DO name servers with no records in DO. | | | | Discourse | Vulnerable | 🟩 | trydiscourse.com | NXDOMAIN | [Issue #49](https://github.com/EdOverflow/can-i-take-over-xyz/issues/49) | [Hackerone](https://hackerone.com/reports/264494) | | Dreamhost | Not vulnerable | πŸŸ₯ | | Site Not Found Well, this is awkward. The site you're looking for is not here. | [Issue #153](https://github.com/EdOverflow/can-i-take-over-xyz/issues/153) [Issue #5](https://github.com/shifa123/Can-I-take-over-xyz-v2/issues/5v) | | | Fastly | Not vulnerable | πŸŸ₯ | | Fastly error: unknown domain: | [Issue #22](https://github.com/EdOverflow/can-i-take-over-xyz/issues/22) | | | Feedpress | Not vulnerable | πŸŸ₯ | | The feed has not been found. | [Issue #80](https://github.com/EdOverflow/can-i-take-over-xyz/issues/80) | | | Firebase | Not vulnerable | πŸŸ₯ | | | [Issue #128](https://github.com/EdOverflow/can-i-take-over-xyz/issues/128) | | | Fly.io | Not vulnerable | πŸŸ₯ | | 404 Not Found | [Issue #101](https://github.com/EdOverflow/can-i-take-over-xyz/issues/101) | | | Freshdesk | Not vulnerable | πŸŸ₯ | | We couldn't find servicedesk.victim.tld Maybe this is still fresh! You can claim it now at http://www.freshservice.com/signup | [Issue #214](https://github.com/EdOverflow/can-i-take-over-xyz/issues/214) | [Freshdesk Support Page](https://support.freshdesk.com/support/solutions/articles/37590-using-a-vanity-support-url-and-pointing-the-cname) | | Frontify | Edge case | πŸŸ₯ | | 404 - Page Not Found Oops… looks like you got lost | [Issue #170](https://github.com/EdOverflow/can-i-take-over-xyz/issues/170) | | | Gemfury | Vulnerable | 🟩 | furyns.com | 404: This page could not be found. | [Issue #154](https://github.com/EdOverflow/can-i-take-over-xyz/issues/154) | [Article](https://khaledibnalwalid.wordpress.com/2020/06/25/gemfury-subdomain-takeover/) | | Getresponse | Vulnerable | πŸŸ₯ | | With GetResponse Landing Pages, lead generation has never been easier | [Issue #235](https://github.com/EdOverflow/can-i-take-over-xyz/issues/235) | | | Ghost | Vulnerable | πŸŸ₯ | ghost.io | Site unavailable\\.|Failed to resolve DNS path for this host | [Issue #89](https://github.com/EdOverflow/can-i-take-over-xyz/issues/89) | | | Github | Edge case | πŸŸ₯ | | There isn't a GitHub Pages site here. | [Issue #37](https://github.com/EdOverflow/can-i-take-over-xyz/issues/37) [Issue #68](https://github.com/EdOverflow/can-i-take-over-xyz/issues/68) | | | Gitlab | Not vulnerable | πŸŸ₯ | | | [HackerOne #312118](https://hackerone.com/reports/312118) | | | Google Cloud Storage | Not vulnerable | πŸŸ₯ | | NoSuchBucketThe specified bucket does not exist. | | | | Google Sites | Not vulnerable | πŸŸ₯ | | The requested URL was not found on this server. That’s all we know. | [Issue #277](https://github.com/EdOverflow/can-i-take-over-xyz/issues/277) | [Google Support](https://support.google.com/webmasters/answer/9008080?visit%5Fid=637981741431097680-3818919062&rd=2) | | HatenaBlog | Vulnerable | 🟩 | hatenablog.com | 404 Blog is not found | | | | Help Juice | Vulnerable | 🟩 | helpjuice.com | We could not find what you're looking for. | | [Help Juice Support Page](https://help.helpjuice.com/en%5FUS/using-your-custom-domain/how-to-set-up-a-custom-domain) | | Help Scout | Vulnerable | 🟩 | helpscoutdocs.com | No settings were found for this company: | | [HelpScout Docs](https://docs.helpscout.net/article/42-setup-custom-domain) | | Helprace | Vulnerable | 🟩 | helprace.com | HTTP\_STATUS=301 | [Issue #115](https://github.com/EdOverflow/can-i-take-over-xyz/issues/115) | | | Heroku | Edge case | πŸŸ₯ | | No such app | [Issue #38](https://github.com/EdOverflow/can-i-take-over-xyz/issues/38) | | | HubSpot | Not vulnerable | πŸŸ₯ | | This page isn't available | [Issue #59](https://github.com/EdOverflow/can-i-take-over-xyz/issues/59) | | | Instapage | Not vulnerable | πŸŸ₯ | | | [Issue #73](https://github.com/EdOverflow/can-i-take-over-xyz/issues/73) | | | Intercom | Edge case | πŸŸ₯ | | Uh oh. That page doesn't exist. | [Issue #69](https://github.com/EdOverflow/can-i-take-over-xyz/issues/69) | [Help center](https://www.intercom.com/help/) | | JetBrains | Vulnerable | πŸŸ₯ | youtrack.cloud | is not a registered InCloud YouTrack | [PR #107](https://github.com/EdOverflow/can-i-take-over-xyz/pull/107) | [YouTrack InCloud Help Page](https://www.jetbrains.com/help/youtrack/incloud/Domain-Settings.html) | | Key CDN | Not vulnerable | πŸŸ₯ | | | [Issue #112](https://github.com/EdOverflow/can-i-take-over-xyz/issues/112) | | | Kinsta | Not vulnerable | πŸŸ₯ | | No Site For Domain | [Issue #48](https://github.com/EdOverflow/can-i-take-over-xyz/issues/48) | [kinsta-add-domain](https://kinsta.com/knowledgebase/add-domain/) | | Landingi | Edge case | πŸŸ₯ | | It looks like you’re lost... | [Issue #117](https://github.com/EdOverflow/can-i-take-over-xyz/issues/117) | | | LaunchRock | Vulnerable | πŸŸ₯ | launchrock.com | HTTP\_STATUS=500 | [Issue #74](https://github.com/EdOverflow/can-i-take-over-xyz/issues/74) | | | Mailchimp | Not vulnerable | πŸŸ₯ | | We can't find that page It looks like you're trying to reach a page that was built by Mailchimp but is no longer active. | [Discussion #250](https://github.com/EdOverflow/can-i-take-over-xyz/discussions/250) | | | Mashery | Edge case | πŸŸ₯ | | Unrecognized domain | [Issue #14](https://github.com/EdOverflow/can-i-take-over-xyz/issues/14) | [HackerOne](https://hackerone.com/reports/275714) | | Microsoft Azure | Vulnerable | 🟩 | cloudapp.net, cloudapp.azure.com, azurewebsites.net, blob.core.windows.net, cloudapp.azure.com, azure-api.net, azurehdinsight.net, azureedge.net, azurecontainer.io, database.windows.net, azuredatalakestore.net, search.windows.net, azurecr.io, redis.cache.windows.net, azurehdinsight.net, servicebus.windows.net, visualstudio.com | NXDOMAIN | [Issue #35](https://github.com/EdOverflow/can-i-take-over-xyz/issues/35) | | | Netlify | Edge case | πŸŸ₯ | | Not Found - Request ID: | [Issue #40](https://github.com/EdOverflow/can-i-take-over-xyz/issues/40) | | | Ngrok | Vulnerable | 🟩 | ngrok.io | Tunnel .\*.ngrok.io not found | [Issue #92](https://github.com/EdOverflow/can-i-take-over-xyz/issues/92) | [Ngrok Documentation](https://ngrok.com/docs#http-custom-domains) | | Pantheon | Vulnerable | πŸŸ₯ | | 404 error unknown site! | [Issue #24](https://github.com/EdOverflow/can-i-take-over-xyz/issues/24) | [Documentation](https://pantheon.io/docs/guides/domains/custom-domains) [Pantheon-Sub-takeover](https://medium.com/@hussain%5F0x3c/hostile-subdomain-takeover-using-pantheon-ebf4ab813111) | | Pingdom | Vulnerable | πŸŸ₯ | | Sorry, couldn't find the status page | [Issue #144](https://github.com/EdOverflow/can-i-take-over-xyz/issues/144) | [Support Page](https://help.pingdom.com/hc/en-us/articles/205386171-Public-Status-Page) | | Readme.io | Vulnerable | πŸŸ₯ | readme.io | The creators of this project are still working on making everything perfect! | [Issue #41](https://github.com/EdOverflow/can-i-take-over-xyz/issues/41) | | | Readthedocs | Vulnerable | πŸŸ₯ | | The link you have followed or the URL that you entered does not exist. | [Issue #160](https://github.com/EdOverflow/can-i-take-over-xyz/issues/160) | | | Sendgrid | Not vulnerable | πŸŸ₯ | | | | | | Shopify | Edge case | πŸŸ₯ | | Sorry, this shop is currently unavailable. | [Issue #32](https://github.com/EdOverflow/can-i-take-over-xyz/issues/32) [Issue #46](https://github.com/EdOverflow/can-i-take-over-xyz/issues/46) | [Medium Article](https://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75) | | Short.io | Vulnerable | πŸŸ₯ | | Link does not exist | [Issue #260](https://github.com/EdOverflow/can-i-take-over-xyz/issues/260) | | | SmartJobBoard | Vulnerable | 🟩 | 52.16.160.97 | This job board website is either expired or its domain name is invalid. | [Issue #139](https://github.com/EdOverflow/can-i-take-over-xyz/issues/139) | [Support Page](https://help.smartjobboard.com/en/articles/1269655-connecting-a-custom-domain-name) | | Smartling | Edge case | πŸŸ₯ | | Domain is not configured | [Issue #67](https://github.com/EdOverflow/can-i-take-over-xyz/issues/67) | | | Smugsmug | Vulnerable | πŸŸ₯ | | | [Issue #60](https://github.com/EdOverflow/can-i-take-over-xyz/issues/60) | | | Squarespace | Not vulnerable | πŸŸ₯ | | | | | | Statuspage | Not vulnerable | πŸŸ₯ | | | Status page pushed a DNS verification in order to prevent malicious takeovers what they mentioned in [This Doc](https://support.atlassian.com/statuspage/docs/configure-your-dns/) [PR #105](https://github.com/EdOverflow/can-i-take-over-xyz/pull/105) [PR #171](https://github.com/EdOverflow/can-i-take-over-xyz/pull/171) | [Statuspage documentation](https://help.statuspage.io/knowledge%5Fbase/topics/domain-ownership) | | Strikingly | Vulnerable | 🟩 | s.strikinglydns.com | PAGE NOT FOUND. | [Issue #58](https://github.com/EdOverflow/can-i-take-over-xyz/issues/58) | [Strikingly-Sub-takeover](https://medium.com/@sherif0x00/takeover-subdomains-pointing-to-strikingly-5e67df80cdfd) | | Surge.sh | Vulnerable | 🟩 | na-west1.surge.sh | project not found | [Issue #198](https://github.com/EdOverflow/can-i-take-over-xyz/issues/198) | [Surge Documentation](https://surge.sh/help/adding-a-custom-domain) | | SurveySparrow | Vulnerable | 🟩 | surveysparrow.com | Account not found. | [Issue #281](https://github.com/EdOverflow/can-i-take-over-xyz/issues/281) | [Custom domain](https://help.surveysparrow.com/custom-domain) | | Tilda | Edge case | πŸŸ₯ | | Please renew your subscription | [Issue #155](https://github.com/EdOverflow/can-i-take-over-xyz/issues/155) [PR #20](https://github.com/EdOverflow/can-i-take-over-xyz/pull/20) | | | Tumblr | Edge case | πŸŸ₯ | | Whatever you were looking for doesn't currently exist at this address | [Issue #240](https://github.com/EdOverflow/can-i-take-over-xyz/issues/240) | [Tumblr Custom Domains](https://www.tumblr.com/docs/en/custom%5Fdomains) | | Uberflip | Vulnerable | 🟩 | read.uberflip.com | The URL you've accessed does not provide a hub. | [Issue #150](https://github.com/EdOverflow/can-i-take-over-xyz/issues/150) | [Uberflip Documentation](https://help.uberflip.com/hc/en-us/articles/360018786372-Custom-Domain-Set-up-Your-Hub-on-a-Subdomain) | | Unbounce | Not vulnerable | πŸŸ₯ | | The requested URL was not found on this server. | [Issue #11](https://github.com/EdOverflow/can-i-take-over-xyz/issues/11) | | | Uptimerobot | Vulnerable | πŸŸ₯ | stats.uptimerobot.com | page not found | [Issue #45](https://github.com/EdOverflow/can-i-take-over-xyz/issues/45) | [Uptimerobot-Sub-takeover](https://exploit.linuxsec.org/uptimerobot-com-custom-domain-subdomain-takeover/) | | UserVoice | Not vulnerable | πŸŸ₯ | | This UserVoice subdomain is currently available! | [Issue #163](https://github.com/EdOverflow/can-i-take-over-xyz/issues/163) | | | Vercel | Edge case | πŸŸ₯ | | DEPLOYMENT\_NOT\_FOUND. | [Issue #183](https://github.com/EdOverflow/can-i-take-over-xyz/issues/183) | [Adding & Configuring a Custom Domain](https://vercel.com/docs/concepts/projects/domains/add-a-domain) | | WP Engine | Not vulnerable | πŸŸ₯ | | | | | | Webflow | Edge case | πŸŸ₯ | | The page you are looking for doesn't exist or has been moved. | [Issue #44](https://github.com/EdOverflow/can-i-take-over-xyz/issues/44) | [forum webflow](https://forum.webflow.com/t/hosting-a-subdomain-on-webflow/59201) | | Wix | Edge case | πŸŸ₯ | | Looks Like This Domain Isn't Connected To A Website Yet! | [Issue #231](https://github.com/EdOverflow/can-i-take-over-xyz/issues/231) | | | Wordpress | Vulnerable | 🟩 | wordpress.com | Do you want to register .\*.wordpress.com? | [PR #176](https://github.com/EdOverflow/can-i-take-over-xyz/pull/176) | | | Worksites | Vulnerable | 🟩 | worksites.net, 69.164.223.206 | Hello! Sorry, but the website you’re looking for doesn’t exist. | [Issue #142](https://github.com/EdOverflow/can-i-take-over-xyz/issues/142) | | | Zendesk | Not vulnerable | πŸŸ₯ | | Help Center Closed | [Issue #23](https://github.com/EdOverflow/can-i-take-over-xyz/issues/23) | [Zendesk Support](https://support.zendesk.com/hc/en-us/articles/203664356-Changing-the-address-of-your-Help-Center-subdomain-host-mapping-) |