Threat tactic spotlight: Subdomain takeover

This AWS CIRT blog post explains subdomain takeover—how dangling CNAME DNS records to deleted AWS resources can be exploited by attackers—describes observed scanning activity, outlines impacts such as phishing and reputational damage, and provides detection and mitigation guidance including an AWS Config-based detection implementation, deprovisioning SOPs, and response recommendations.