Dead Infrastructure Hijacking (DIH) is the exploitation of residual trust relationships left when services, domains, or cloud storage are decommissioned, allowing an attacker who reclaims those endpoints to inherit trust and receive sensitive traffic without exploiting vulnerabilities. The report details three confirmed variants—SaaS CNAME subdomain takeover, expired domain registration, and cloud bucket squatting—corrects misconceptions about CAA and DNSSEC, and recommends organizational and technical mitigations including AWS Account Regional Namespaces and CT/historical DNS auditing. #AWSAccountRegionalNamespaces #CloudBucketSquatting