# SiteCheck Web Intel – Subdomain Takeover Checker

> SiteCheck Web Intel – Subdomain Takeover Checker is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks a subdomain for potential takeover vulnerability by resolving its CNAME, matching the target against the can-i-take-over-xyz fingerprint list, and fetching the subdomain to detect unclaimed service pages.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/subdomain-takeover?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-subdomain-takeover-checker-1e44c72a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YBJgcH_ClZI26uPAk-TmW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-subdomain-takeover-checker-1e44c72a
```

Example prompt: Can you check if staging.example.com is vulnerable to a subdomain takeover — see if its CNAME points to an unclaimed service like GitHub Pages, S3, or Azure?

## When to prefer this

Use this endpoint when you need a quick, automated evidence-gathering pass on a specific subdomain to assess takeover risk. It is especially useful during security audits, red team reconnaissance, post-offboarding infrastructure reviews, or continuous monitoring of DNS hygiene. Prefer this over manual DNS lookups when you want integrated CNAME resolution, fingerprint matching, DNS liveness check, and page content analysis in a single call. Note that verdicts are evidence-based, not proof — follow up with manual verification for confirmed findings.

## Known failure modes

- Subdomain does not resolve or has no CNAME record — returns DNS failure or no-CNAME result
- Target service not in the community fingerprint list — verdict may be inconclusive
- Service's unclaimed page text has changed — fingerprint match may produce false negatives
- Network timeout fetching the subdomain — page content check may be skipped
- False positives possible if a service reuses takeover-like page text for legitimate pages
- Community fingerprint list may be outdated for newer services

## How this service works

For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPress), checks whether the target still resolves, and fetches the subdomain once to look for the service's 'unclaimed' page text. Verdicts are evidence, not proof; the list is community-maintained.

## Output

Returns the resolved CNAME target for the subdomain, whether that target matches a known vulnerable service from the can-i-take-over-xyz fingerprint list (including service name such as GitHub Pages, S3, Azure, WordPress), whether the target host still resolves via DNS, and whether a fetch of the subdomain reveals an 'unclaimed' or error page typical of vulnerable services. Includes a verdict indicating takeover risk level based on collected evidence.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "subdomain"
     ],
     "properties": {
      "subdomain": {
       "type": "string",
       "description": "Host name to check, e.g. staging.wordpress.com (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-subdomain-takeover-checker-1e44c72a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)