{"uid":"cap_YBJgcH_ClZI26uPAk-TmW","slug":"sitecheck-web-intel-subdomain-takeover-checker-1e44c72a","name":"SiteCheck Web Intel – Subdomain Takeover Checker","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPress), checks whether the target still resolves, and fetches the subdomain once to look for the service's 'unclaimed' page text. Verdicts are evidence, not proof; the list is community-maintained.","url":"https://api.webintel-api.workers.dev/api/security/subdomain-takeover?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["subdomain"],"properties":{"subdomain":{"type":"string","description":"Host name to check, e.g. staging.wordpress.com (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pQhN-VAI4_TlMCqDKbmSs","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a subdomain for potential takeover vulnerability by resolving its CNAME, matching the target against the can-i-take-over-xyz fingerprint list, and fetching the subdomain to detect unclaimed service pages.","exampleAgentPrompt":"Can you check if staging.example.com is vulnerable to a subdomain takeover — see if its CNAME points to an unclaimed service like GitHub Pages, S3, or Azure?","exampleUseCases":[{"title":"Audit staging subdomain for hijacking risk","prompt":"Check whether staging.acmecorp.com is vulnerable to subdomain takeover — does its CNAME point to an unclaimed GitHub Pages, S3, or Azure service?"},{"title":"Red team recon on competitor subdomain","prompt":"Run a subdomain takeover check on old.shopify-demo.com and tell me if its CNAME resolves to a service that could be claimed by someone else."},{"title":"Post-offboarding infrastructure cleanup","prompt":"We recently decommissioned our Heroku app but I'm not sure if the DNS was cleaned up — can you check if docs.mycompany.com is now dangling and at risk of being taken over?"}],"resultDescription":"Returns the resolved CNAME target for the subdomain, whether that target matches a known vulnerable service from the can-i-take-over-xyz fingerprint list (including service name such as GitHub Pages, S3, Azure, WordPress), whether the target host still resolves via DNS, and whether a fetch of the subdomain reveals an 'unclaimed' or error page typical of vulnerable services. Includes a verdict indicating takeover risk level based on collected evidence.","failureModes":["Subdomain does not resolve or has no CNAME record — returns DNS failure or no-CNAME result","Target service not in the community fingerprint list — verdict may be inconclusive","Service's unclaimed page text has changed — fingerprint match may produce false negatives","Network timeout fetching the subdomain — page content check may be skipped","False positives possible if a service reuses takeover-like page text for legitimate pages","Community fingerprint list may be outdated for newer services"],"whenToPreferThis":"Use this endpoint when you need a quick, automated evidence-gathering pass on a specific subdomain to assess takeover risk. It is especially useful during security audits, red team reconnaissance, post-offboarding infrastructure reviews, or continuous monitoring of DNS hygiene. Prefer this over manual DNS lookups when you want integrated CNAME resolution, fingerprint matching, DNS liveness check, and page content analysis in a single call. Note that verdicts are evidence-based, not proof — follow up with manual verification for confirmed findings.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:26.303Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-subdomain-takeover-checker-1e44c72a"}