A Stranger Took Over My Subdomain After I Canceled an App
This morning I got an email from Google Search Console letting me know that an email address I had never seen before had been added as an owner of shop.destinicopp.com.
I loaded the page to see what was there. It was an online gambling site written in Indonesian, promoting lottery games and slot machines, and it was sitting on my domain. My domain name was in the page code too, which is what search engines read to decide who a page belongs to, so as far as Google was concerned this was my content.
Nobody hacked me. My Google account was fine, my Squarespace was fine, my Shopify was fine. No password was taken and no login was involved. I set this up myself back in August and never finished undoing it, and if you run your business on a stack of apps, the same thing can happen to you.
What I found on my own domain.
Once I understood what happened, I went through every record on destinicopp.com and checked what was actually live on the other end.
Five subdomains pointing at apps with nothing on the other end. A Lovable project I'd deleted, one I never finished, a SparkLoop link that went nowhere, an email subdomain from something I couldn't identify anymore, and the Shopify one somebody had already taken.
A stranger could have claimed any of those five the same way they claimed shop.destinicopp.com.
How it actually happened
Back in August I opened a Shopify store to sell a library of Claude skills. Connecting it to my own domain took two separate steps in two separate places.
In Squarespace, where my domain lives, I added a record that says anyone looking for shop.destinicopp.com should go to Shopify. That's all a DNS record is, a signpost telling internet traffic which way to go.
Then inside Shopify I typed shop.destinicopp.com into my store's domain settings, because Shopify runs millions of stores out of one building and it needs to know which store to show when somebody arrives at my address.
In early September I decided I wasn't doing the skills shop, and I canceled the Shopify plan. That undid the Shopify half. My store came off their list and shop.destinicopp.com went back to being an unclaimed name inside their system.
My signpost was still standing out on the road, still pointing everyone toward Shopify. Canceling a store doesn't reach into your domain settings and clean that up, because Shopify can't edit my DNS and Squarespace has no idea I canceled anything. Neither one told the other, and neither one told me.
"Canceling the account and taking down the signpost are two different jobs, and I only did one of them."
Then a script found it. There are programs running around the clock looking for domains that still point at a big platform where nobody has claimed the name on the platform's side. Each one they find is a free web page on somebody else's established domain, which is worth money to a spammer. Mine turned up in one of those sweeps. Nobody went looking for me specifically.
So they opened their own Shopify store and typed shop.destinicopp.com into the domain settings, the same box I used in August. Shopify ran the only check it does, which is whether the domain points at them right now, and my leftover signpost answered yes. My subdomain got assigned to their store, and their gambling page started loading on my address.
They also used it to get into Google. Because they controlled what was served at shop.destinicopp.com, they could prove to Google that they owned it, which is how a stranger ended up as a verified owner of part of my domain in Search Console. That's the email that showed up in my inbox.
Why this is bigger now than it used to be
A few years ago most of us had a website and a shopping cart and that was the whole stack. I now count Kit, Shopify, ThriveCart, Leadpages, HTMLPub, Lovable, Skool and a handful of others across two brands, and almost every one of them wants a subdomain so your links look like yours instead of theirs.
So you end up with a lot of signposts, and each one has to come down when you're done with it.
And we cancel things constantly. We try an app for a quarter, test a tool for one launch, build something in Lovable and abandon it, move a community from one platform to another. Every one of those leaves a signpost standing unless you take it down on purpose, and nothing in the cancellation process reminds you.
Delete the DNS record first, then cancel the account.
Deleting the record only takes the subdomain offline, which is what you wanted anyway, and it closes the gap before it can ever open. Cancel first and the subdomain sits there unclaimed and available for however long it takes you to remember.
How to check your own domain today.
This takes about twenty minutes and you don't need a developer.
Pull up your DNS records
They live wherever you bought or manage your domain, so Squarespace, GoDaddy, Namecheap, or Cloudflare. Look for a section called DNS settings or DNS records. You'll see a long list of rows that look like gibberish, and that's normal.
Load every one of them in a private window
Take each name on your list and put it in front of your domain, so if you see "shop" you load shop.yourdomain.com. Use a private or incognito window so you see what a stranger sees instead of something cached in your browser.
Deal with the two piles that aren't yours
Anything showing content you don't recognize has already been claimed, and deleting the record cuts it off immediately. Anything showing a not found error or failing to load is available for someone to claim, so delete those too.
Check Google Search Console while you're in there
If one of yours was taken, whoever took it may have verified themselves as an owner the way mine did. Look under Users and permissions for any email you don't recognize, and remove them after you've deleted the DNS record, not before.
DNS is completely reversible. If you delete something and a page you needed stops working, you add the record back with the same values and it's fixed in two minutes. There's no permanent version of this mistake, so I'd rather you delete an uncertain record than leave it standing.
Why this is easy to miss
Two reasons.
DNS settings look like developer territory. You open the panel and see rows of letters and numbers that mean nothing, and I avoided mine for years because of that. But there's only one thing in that panel you need to understand, which is that each row is a signpost pointing your traffic somewhere, and you can check where it goes by loading the address in a browser.
The second reason is that nothing in the process prompts you. When you cancel a tool you get a confirmation screen about billing and data, and not one word about the domain you connected six months ago. The app can't see your DNS and your domain provider can't see your account, so there's no system anywhere that knows to tell you.
Some platforms make you add a second record to prove you own the domain before they'll let anybody connect it, which makes them much harder to take over because a stranger would have to get into your DNS to do it. Others only check whether your domain points at them, which is the easy kind, and that's what happened with mine. You can't tell from the outside which is which, and a platform can change how it works without telling you, so treat them all the same way.
The rule going forward
When I stop using a tool now, I delete the DNS record in the same sitting that I cancel the account, and I do the record first because that's the half I'm most likely to forget once the billing is handled and I've moved on to the next thing.
Your domain is the one piece of your business that doesn't live on somebody else's platform. Your email list is on Kit, your courses are on ThriveCart, your community is on Skool, and any one of those could change their pricing or their terms or shut down. The domain is yours and everything else hangs off of it, so it's worth twenty minutes a couple of times a year to make sure you still control all of it.
Go check yours.
Not sure where your business is leaking?
The Creator Business Scorecard walks you through the five stages of your growth system in about two minutes and tells you which one is your weak link right now.
Take the free scorecard →Frequently asked.
What is a subdomain takeover?
A subdomain takeover happens when your domain still points at an app or platform, but nobody has claimed that address on the platform's side anymore. A stranger can sign up for that same platform, type in your subdomain, and the platform hands it to them because your DNS record says to send traffic there. From then on, their content loads on your domain.
What happens to my DNS records when I cancel a service?
Nothing. Canceling an account inside an app does not reach back into your domain settings and remove anything. The app has no ability to edit your DNS, and your domain provider has no idea you canceled anything. The record keeps pointing at that platform until you delete it yourself.
Can someone take over my subdomain without hacking my account?
Yes. No password, email access, or login is involved. The leftover DNS record is the only thing they need, because it answers the platform's ownership check on their behalf. This is why a takeover can happen to someone with strong passwords and two-factor authentication on every account.
How do I know if one of my subdomains has been taken over?
Open your DNS settings, make a list of every subdomain you see, and load each one in a private browser window. Anything showing a page you do not recognize has been claimed by someone else. Anything showing a not found error or failing to load is available for someone to claim next.
What should I do when I stop using an app that has my subdomain?
Delete the DNS record first, then cancel the account. Deleting the record only takes the subdomain offline, which is what you wanted anyway, and it closes the gap before it can open. If you cancel first and forget the record, the subdomain sits unclaimed and available.
Dr. Destini Copp helps digital product creators build sustainable, systems-based businesses through the Creator Growth Flywheel framework. She's the founder of Creator's MBA and HobbyScool, and has been teaching online business strategy for over a decade. Learn more →
