Large enterprises, universities, and media networks constantly spin up marketing campaigns on `promo.brand.com` or `events.university.edu` pointed via `CNAME` to GitHub Pages, AWS S3, Azure Traffic Manager, Fastly, or Render—and then delete the cloud resource when the campaign ends without removing the DNS `CNAME` record! ### Continuous Subdomain Takeover Pipeline: ```bash # 1. Enumerate all subdomains from Certificate Transparency logs & passive DNS subfinder -dL authority_domains.txt -all -silent | dnsx -cname -resp -silent > cname_map.txt # 2. Check for unclaimed cloud endpoints returning NXDOMAIN or 404 NoSuchBucket nuclei -l cname_map.txt -t http/takeovers/ -o vulnerable_subdomains.txt ``` Whether you report them for $500–$2,500 Bug Bounty payouts on HackerOne or study how parasitic subdomain authority inheritance works, dangling CNAMEs are everywhere.