Hacker News Reader

Happens with GitHub Pages too. You can crawl for repos with CNAME file and if any of those repos is removed or CNAME is removed, you can takeover.

I believe this is now hardened a bit by setting the CNAME to a GitHub domain with the user/org as subdomain.

I don't imagine it to be hard to build a bot that go thru subdomains and see which ones are possible to takeover.

Typically prevented by having unique identifier by mapping CNAME to virtual host, i.e. someid.virtual.provider.com

Subdomain Takeovers