When you connect a subdomain such as demo.yourapp.com to a hosting platform, you usually add a CNAME record that points at an address owned by that platform. If you later delete the project but leave the DNS record in place, the record is left dangling. On some platforms anyone can create a new project that answers at the abandoned address, and your subdomain starts serving their content.
This matters more than a defaced page. Content on your subdomain is trusted by visitors and by browsers. Depending on how cookies and policies are scoped, a hostile subdomain can receive cookies set for the parent domain, host convincing phishing pages and obtain a valid certificate for that name.
People who build quickly collect these records without noticing: a preview on one host, a landing page on another, a docs site that was abandoned. Remove the DNS record before or at the same time as you delete the resource, review your DNS zone regularly, and avoid setting cookies for the whole parent domain unless you have to.
Go deeper
- Security checkSubdomain takeover: dangling DNS records to clean up