Fingerprint dangling CNAMEs that point at unclaimed third-party services for takeover.
Subdomain Takeover Scanner checks whether a hostname’s CNAME points to a third-party service (S3, GitHub Pages, Heroku, and many more) that is no longer claimed — a condition that can let an attacker host content on the victim’s subdomain.
It matches responses against a library of service fingerprints and tells you whether a takeover is likely possible, with the evidence behind the verdict.
A match is a strong lead, but always confirm by checking the service’s claim process. Some fingerprints overlap with not-yet-provisioned but owned resources.