Creator's MBA

The AI Edition

One AI insight, one build, one move you can use this week.

Was this forwarded to you? Subscribe here so you don't miss the next one.

The AI Insight

Nobody Hacked Me

And I still lost control of a subdomain I own.

Last week Google emailed me to say that somebody I'd never heard of had added themselves as an owner of shop.destinicopp.com. That's one of my own web addresses. I loaded it up to see what was there, and it was an online gambling site written in Indonesian, selling lottery games and slot machines, with my domain name on the page.

No password was taken and nobody logged into anything of mine. Back in August I pointed that address at a Shopify store, and setting that up takes two steps in two different places. Step one is in Squarespace where I manage my domain, telling it to send anybody who types shop.destinicopp.com over to Shopify. Step two is inside Shopify, typing that same address into my store settings so Shopify knows it belongs to me.

In early September I canceled my Shopify plan, and that undid step two. Step one was still sitting there, because Shopify can't reach into my Squarespace and change my settings, and Squarespace had no idea I'd canceled anything. So a stranger opened their own Shopify store and typed my address into their store settings, the same box I'd used in August. The only thing Shopify checks is whether that address is currently being sent to Shopify, and mine was, so Shopify gave it to them.

Their gambling page was up at my address for weeks before Google emailed me. Canceling Shopify only did half the job, and I never went back and did the other half.

The Build

I Had Claude Read My Domain Settings

Once I understood what happened I knew I had to go through the rest of my addresses, and that's where most people stop, because what you're looking at in your domain settings is a long list of lines that reads like gibberish. I had more than forty of them and I couldn't have told you what half of them were for.

So I copied the whole list out of Squarespace and handed it to Claude and asked it to tell me what each line was pointing at and whether anything was still there. It came back with five addresses still pointing at apps I'd stopped using, where nothing loaded anymore. A Lovable project I'd deleted, one I never finished, a SparkLoop link that went nowhere, one I'd set up for sending email from a tool I couldn't even identify, and the Shopify one somebody had already taken. A stranger could have grabbed any of the other four the same way.

I deleted 17 lines and the whole thing took me about twenty minutes. Here's what I pasted in, and it works the same in ChatGPT.

Then I set up a check that runs on the first of every month on its own. It goes through every subdomain I own on both of my domains, loads each one, and tells me whether my own site comes up, whether nothing comes up at all, or whether somebody else's site is showing up on it. It messages me on my phone when it's done, and when nothing's wrong the message is two sentences.

I wrote the whole story up on the blog, with the steps spelled out. A Stranger Took Over My Subdomain After I Canceled an App →

Your Move

Please Go Check Yours This Week

Log in wherever you bought your domain, so Squarespace, GoDaddy, Namecheap or Cloudflare, and find the section called DNS settings. Copy the whole list and paste it into Claude with the prompt above. None of that information is private, so you're not handing over anything a stranger couldn't already look up, and you don't have to understand any of it, which is the point of handing it over.

Before you delete a single thing, know that there are three kinds of lines you leave alone no matter what. Your @ and www lines, because those are your main website. Your MX lines, because those are what deliver your email. And the TXT lines underneath them with SPF, DKIM or DMARC in them, because those are what keep the email you send out of everybody's spam folder. They look like gibberish same as everything else and deleting one takes down your sending, so that's why the prompt tells Claude to keep its hands off them.

Then go load every address it comes back with yourself, in a private or incognito window so you see what a stranger sees. Anything showing a page you don't recognize has already been taken. Anything that won't load or says page not found is available for somebody to take next. Delete both kinds. Screenshot a line before you delete it, and know that none of this is permanent, so if something breaks you add the line back and it's fixed in two minutes.

And from now on, when you stop using an app, go delete the line in your domain settings first and cancel the account second. If you cancel first and forget to come back, that address is sitting there open for somebody to take the whole time you're not thinking about it.

All four steps are written out here →

Setting up that monthly check took me an afternoon, and it's the same kind of work 22 creators walked through at AI in Action Summit last week. The free days are over, but the VIP Pass keeps all 27 workshops for good, plus the resource vault, the Playbook and the transcripts. It's $97.

Before You Go

Go check yours,
Destini