"Detects dangling DNS records pointing to deleted or expired external services."
Subdomain takeover is a critical vulnerability where a DNS record (usually a CNAME) points to an external service — an S3 bucket, a GitHub Pages site, a Heroku app, a Fastly endpoint — that has since been deleted. An attacker can claim that external service and now controls what subdomain.example.com serves.
This affects major organizations regularly. A deleted Heroku app, an archived GitHub Pages repository, an abandoned Azure endpoint — if the DNS record still points to it, the subdomain is vulnerable. This tool checks each target against dozens of known-vulnerable service fingerprints.