miji.beSubdomain takeover is an attack technique in which an attacker hijacks a subdomain by exploiting a state where the DNS record (mainly a CNAME) of a subdomain that an organization has stopped using still remains. For example, if blog.example.com keeps a CNAME record pointing to an external service after the account on that service has been deleted, an attacker can create a new account on the same service and seize control of the subdomain.
The attack works as follows. An organization runs a subdomain on an external service such as AWS S3, GitHub Pages, or Heroku and later cancels the service. However, if it forgets to delete the CNAME record in DNS, the subdomain is left "dangling." The attacker registers the same hostname on the target external service and becomes able to serve any content. Because it is a subdomain of the legitimate domain, it may be abused for phishing or for stealing Cookies.
This risk also exists when an organization sets up a custom domain with a URL shortener. When the organization stops using the URL shortener, if it does not delete the custom domain's CNAME record from DNS, an attacker may take over the subdomain. If malicious short URLs are issued on the hijacked subdomain, phishing attacks that exploit the trustworthiness of the organization's domain become possible.
OWASP's Web Security Testing Guide lists removing the relevant DNS records from the zone as a countermeasure and recommends continuous monitoring and periodic checks (as of October 2026). The same guide lists subzy and nuclei as tools for detecting subdomain takeovers. On the operations side, another approach is to add DNS record deletion to the checklist used when canceling a service. In addition, specifying in a CAA record (RFC 8659) which certificate authorities are allowed to issue certificates can reduce the risk of unintended certificate issuance.