OSINT · Subdomain Intelligence
Enumerate subdomains from Certificate Transparency logs, HackerTarget, AlienVault OTX, and RapidDNS. Resolve full CNAME chains, detect NS delegation takeovers, identify wildcard zones, and fingerprint dangling records against 65+ cloud services.
| Service | CNAME Patterns | HTTP Fingerprint |
|---|
A four-phase enumeration and detection pipeline — all client-side, no proxy, no API keys required.
Queries four passive sources in parallel: crt.sh Certificate Transparency logs, HackerTarget passive DNS, AlienVault OTX threat intelligence, and RapidDNS. Results are deduplicated and normalised before scanning begins.
Before resolving anything, Takeover queries a guaranteed-nonexistent subdomain via DoH. If it resolves, the domain has wildcard DNS — a banner warns you that results may include false positives throughout the scan.
Full CNAME chains are followed (up to 10 hops) via DNS-over-HTTPS. Each subdomain is also checked for NS delegation — dangling NS records pointing to non-existent nameservers indicate a separate, severe class of takeover.
After the full CNAME chain is resolved, the terminal target's A record is queried. An NXDOMAIN response on the final target — even without a fingerprint match — is a strong takeover signal and is flagged as Potential.
Each CNAME match is checked against 65+ service signatures (GitHub Pages, Heroku, S3, Azure, Netlify, Vercel, Railway, Fly.io, Zendesk, Shopify and more). An HTTP fetch attempts to confirm the dangling error page in the response body.
Choose between 5, 10, or 20 concurrent checks. All requests originate from your browser — no data passes through TheAdminStack servers. CORS restrictions apply to HTTP body verification; use the JSON/CSV export with curl to confirm findings.
Responsible Use: Takeover is designed for legitimate security research, bug bounty programmes, red team engagements, and defensive vulnerability assessment of infrastructure you own or have explicit written permission to test. Unauthorised reconnaissance of third-party domains may violate computer fraud laws in your jurisdiction. Use responsibly and in accordance with applicable laws.