Wu Shuo learned that Slow Mist @IM_23pds tweeted a reminder that DNS hijacking has occurred frequently recently. First, Balancer was hijacked, and then Galxe was hijacked and attacked. After analyzing more than 6 million DNS records, looking at A records and CNAMEs pointing to cloud infrastructure, we found that many businesses are vulnerable to subdomain hijacking.