Subdomain takeover is supposedly "dead." Every recon talk in 2021 said it's all automated, all fingerprinted, all deduped. Reality in 2026: I still get paid for it. Two payouts last month alone — one $4,500, one $8,000 — both via dangling CNAMEs that had been "publicly known" for over a year and never fixed. Here's the methodology I actually use, with the parts the talks skip.
What this covers:
The state of subdomain takeover in 2026 (spoiler: still alive)
What "fingerprinted" actually misses
A recon pipeline that finds dangling CNAMEs in hours, not days
