Check 32 of 54 · Domain and registration
A forgotten subdomain still pointing at a cloud service a stranger could sign up for and take over.
Engine 1.57.0, read 25 October 2026
Could you lose the domain, or part of it?
It reads up to 300 of your hostnames from public certificate logs, the most notable first. For any that point at one of a dozen cloud services we know, it reads the page that service shows. That page is read whatever certificate answers, because an abandoned service has none for your name.
Whoever claims the abandoned service controls a page, and a login form, on your own domain.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
It fails, and caps your score at 59, only where the provider's own page proves anyone can claim the name: today, Amazon S3 and Surge. The rest are warnings to check by hand. They include a target name that no longer exists, Heroku's "No such app" page, and GitHub Pages whether or not the account exists. A hostname that did not answer, or sits on Tumblr or Bitbucket, makes the result unknown rather than clean.
It starts from public certificate logs, a shared source with a strict limit, so it runs on a customer's own verified domains, not on the free check.
Check 32 is one of 10 in Domain and registration. See it in its row on the scanner page, beside the rest of Domain and registration.
This check runs on a customer's own verified domains. The free check runs over 40 checks in about 30 seconds, with no account.