readme.io is another service which's subdomains can be taken over if it says "Project doesnt exist... yet!". There's a sign-up button and if someone does, then just simply entering the domain name on custom domain option can take over it.
Proof
I took over developer.bksah.com earlier. but didn't keep any PoC though. But it looks same like that as readme.io hosted sites are a subdomain of readme.io
Subdomain Takeover through readme.io
readme.io is another service which's subdomains can be taken over if it says "Project doesnt exist... yet!". There's a sign-up button and if someone does, then just simply entering the domain name on custom domain option can take over it.
Proof
I took over developer.bksah.com earlier. but didn't keep any PoC though. But it looks same like that as readme.io hosted sites are a subdomain of readme.io
https://xyz124.readme.io/inactive
Documentation
https://readme.readme.io/docs/introduction