Uncover Hidden Subdomains and Expand Your View of the Attack Surface with Subdomains Lookup
Oct 28, 2026 · @disc
The subdomain you forgot is the one attacker find first
Your security program protects the assets you know about. Attackers start with the ones you don’t.
Every organization has a version of the same story: a dev. host spun up for a sprint and never torn down, a staging-api. endpoint left open “just for testing,” a marketing landing page on a SaaS platform that was cancelled two years ago, a chat. or assistant. subdomain someone pointed at an AI pilot. None of them are in the asset register. None of them are in the pentest scope. All of them resolve on the public internet.
That gap between the attack surface you manage and the attack surface that exists is where breaches begin. A subdomains lookup closes it. It is the fastest, lowest-friction way to see your organization the way an adversary does — before they do.
At DISC InfoSec, we’ll run that lookup for you, free. Share your domain and the email address where you want the report, and we’ll send you a subdomain exposure assessment. Details at the end of this post.
Why subdomains become your biggest blind spot
Subdomains are cheap to create and easy to forget. Anyone with DNS access can add one in seconds, and almost nobody is accountable for removing one. Over time, your DNS zone becomes an archaeological record of every project, vendor, and experiment your company has ever run.
The usual sources of hidden subdomains:
- Development and staging environments. dev, test, uat, qa, stage, beta. These often run older code, weaker authentication, verbose error messages, and real data copied from production.
- Shadow IT and SaaS sprawl. Teams point help., status., events. or go. at third-party platforms without security review. When the subscription lapses, the DNS record stays behind.
- Admin and internal tooling exposed by accident. jenkins., grafana., kibana., vpn., mail., sso. — panels that were meant for the internal network but are reachable from anywhere.
- Mergers, acquisitions, and rebrands. Acquired domains and legacy brands carry their own subdomain sprawl, rarely inventoried during integration.
- Forgotten cloud resources. CNAMEs pointing at storage buckets, app services, and CDN endpoints that were deprovisioned while the DNS record lived on.
Each one is a door. Some are locked. Some are propped open. You can’t tell which until you know they exist.
We made a related point in our earlier post on corporate visibility as an attack surface: the information you publish — job postings, leadership bios, tech-stack hints — is reconnaissance material. Subdomains are the infrastructure version of the same problem. Your DNS footprint quietly tells attackers what you run, who you buy from, and where you cut corners.
AI has changed the math on both sides
Subdomain discovery used to take an attacker some patience. It no longer does. AI-orchestrated recon pipelines now chain certificate-transparency queries, passive DNS, live-host probing, crawling and vulnerability templates into one automated run. What a human operator once did in an afternoon, an agent does in minutes — continuously, across thousands of targets.
At the same time, AI adoption is creating new subdomains faster than governance can track them:
- AI application endpoints. chat., ai., copilot., assistant., agent. — customer-facing LLM features stood up by product teams racing to ship.
- Model and inference APIs. inference., llm-api., embeddings. — often protected by a single static API key, sometimes not protected at all.
- MCP servers and agent tool gateways. mcp. and similar hosts expose tools that let a model read data and take actions. An unauthenticated or over-permissioned MCP endpoint is not an information leak; it is a remote control.
- RAG and vector-store front ends. Search and retrieval services that can leak sensitive documents to anyone who asks the right question.
- Shadow AI pilots. Proofs of concept on a vendor platform, wired to production data, and never registered in your AI inventory.
This is where traditional attack surface management and AI governance collide. An exposed AI endpoint inherits every classic web risk — broken authentication, IDOR, SSRF — and adds the AI-specific ones: prompt injection, excessive agency, sensitive-information disclosure, and model abuse that runs up your inference bill. When an agent combines access to private data, exposure to untrusted content, and a way to send data out, a single injected instruction can turn it into an exfiltration channel.
You cannot govern an AI system you don’t know is running. Subdomain discovery is how you find it.
What a subdomains lookup actually reveals
A well-run lookup is passive: it reads public records rather than touching your systems. That makes it safe, fast, and legal to run on your own domain without a change window. The core sources are the same ones attackers use.
| Source | What it shows | Why it matters |
| Certificate transparency logs | Every hostname that has ever received a public TLS certificate | Captures hosts that were never linked from your website — including dev, staging and internal names |
| Passive DNS history | Hostnames observed resolving over time, and where they pointed | Exposes legacy and decommissioned hosts that still resolve |
| DNS record analysis (A, CNAME, MX, TXT) | Current targets, third-party providers, mail and verification records | Reveals your SaaS supply chain and dangling CNAMEs |
| Search engine and archive data | Indexed pages and historical snapshots per subdomain | Surfaces old endpoints, exposed documents and admin pages |
| Live-host and technology fingerprinting | Which hosts respond, on what software and version | Turns a list of names into a prioritized risk view |
The output is more than a list. Correlated properly, it answers the questions that matter to a CISO or a board:
- How big is our real external footprint compared with what’s in our asset inventory?
- Which subdomains are takeover candidates — CNAMEs pointing at cloud or SaaS resources that no longer exist?
- Which non-production environments are internet-facing?
- Where are admin panels, login pages, and APIs exposed?
- Which AI endpoints, model APIs or agent gateways exist — and are they in our AI inventory?
- Which third parties sit inside our trust boundary through DNS delegation?
The risk patterns we see again and again
Subdomain takeover. A CNAME still points at a cloud service, storage bucket or SaaS tenant that was deleted. An attacker claims the abandoned resource and now serves content from your domain — phishing pages, malware, credential harvesters — with your brand and often a valid certificate. In 2024, researchers at Guardio Labs exposed a campaign they named “SubdoMailing” that hijacked thousands of abandoned subdomains belonging to well-known brands and used them to send spam and phishing that passed email authentication checks. The victims’ only mistake was a stale DNS record.
Forgotten environments with real data. Staging and test hosts frequently run with debug modes on, default credentials, or outdated frameworks, while holding copies of production data. They are the easiest pivot point into the main environment.
Exposed admin and CI/CD surfaces. Build servers, dashboards and log viewers reachable from the internet leak secrets, source code and infrastructure details — and some allow code execution outright.
Unregistered AI endpoints. A chatbot or agent on its own subdomain, wired to internal data and tools, outside the AI inventory and outside the risk assessment. No owner, no logging, no prompt-injection testing.
A lesson from our own recon work
In a recent authorized engagement, a quick passive pass against a single client domain surfaced development, WordPress, support, email-routing and ERP subdomains within seconds — the real external footprint.
The instructive part came next. An AI-orchestrated pentest tool processing that same recon data failed while parsing its own output, silently discarded every subdomain, and produced a polished report stating “0 findings — Risk: low.” The raw data proved otherwise.
That is an AI governance failure in miniature: an automated system produced a confident, wrong, board-ready conclusion, and nothing in the pipeline flagged it. Automated recon is essential. Automated recon that no human validates against the raw evidence is a liability. This is exactly the kind of oversight evidence ISO 42001 and the NIST AI RMF expect you to be able to show.
From inventory to governance
Subdomain discovery is not just a technical hygiene task. It is evidence for the controls your auditors, customers and regulators already ask about. Every major framework starts with the same premise: you can only protect, assess and govern what you know you have.
| Framework | Where subdomain discovery fits |
| ISO/IEC 27001:2022 | Annex A 5.9 (inventory of information and other associated assets), 8.8 (management of technical vulnerabilities), 5.23 (information security for use of cloud services) |
| ISO/IEC 42001:2023 | Clause 4.3 scope of the AI management system, AI system inventory, Clause 6.1 AI risk assessment, and Annex A controls on AI system resources and third-party relationships |
| NIST CSF 2.0 | ID.AM (asset management) and ID.RA (risk assessment) under Identify; continuous monitoring under Detect |
| NIST AI RMF 1.0 | MAP (establish context and inventory AI systems) and GOVERN (accountability for every AI system in production) |
| OWASP Top 10 for LLM Applications | Exposed AI endpoints are where prompt injection, sensitive-information disclosure, excessive agency and unbounded consumption are exploited |
| EU AI Act | Providers and deployers must know which AI systems they operate before they can classify risk and meet obligations |
For B2B SaaS and financial services firms, this is increasingly a sales issue, not just a security one. Enterprise buyers send security questionnaires asking how you inventory external assets and AI systems. A documented, recurring subdomain discovery process — with owners, decisions and remediation tracked — is a strong answer. “We don’t know” is not.
A practical subdomain hygiene playbook
- Discover. Run passive enumeration across every domain you own, including acquired and legacy brands. Certificate transparency and passive DNS are the minimum.
- Reconcile. Compare what you found with your asset inventory and CMDB. Every unknown subdomain is a finding until someone claims it.
- Assign ownership. Each live subdomain gets a named business owner and a purpose. No owner, no record.
- Kill dangling records. Remove CNAMEs and A records that point at deprovisioned cloud or SaaS resources. Make DNS cleanup a mandatory step in every decommissioning checklist.
- Restrict non-production. Put dev, test and staging behind SSO, VPN or IP allow-lists. Never put production data in them.
- Register every AI endpoint. Any subdomain serving an LLM feature, model API, agent or MCP server goes into your AI system inventory, gets a risk assessment, and is tested for prompt injection and authorization flaws.
- Validate the automation. If AI tools drive your recon or scanning, check their conclusions against the raw evidence. Log those reviews as oversight evidence.
- Monitor continuously. Your footprint changes weekly. Alert on new certificates and new DNS records for your domains, and repeat full discovery at least quarterly.
The first step is the one most organization have never done properly. That’s where we can help.
Get your free subdomains assessment
Find out what attackers can already see. DISC InfoSec will run a passive subdomains lookup on your domain and send you a report covering:
- Every discoverable subdomain, reconciled into a clean list
- Potential subdomain takeover candidates and dangling DNS records
- Exposed non-production, admin and login surfaces
- AI endpoints, model APIs and agent gateways that should be in your AI inventory
- Third-party providers inside your DNS trust boundary
- Prioritized next steps mapped to ISO 27001, ISO 42001 and NIST CSF 2.0
The assessment is passive: we read public records only and never scan or touch your systems without written authorization.
To request it, share two things:
- Your domain (for example, yourcompany.com)
- The email address where you want DISC InfoSec to send the report
Email info@deurainfosec.com with the subject line “Free Subdomains Assessment,” or call (707) 998-5164. Prefer to talk it through? Book a call.
About DISC InfoSec
DISC InfoSec (Deura Information Security Consulting) is a boutique AI governance and cybersecurity consultancy serving B2B SaaS and financial services firms. Our principal holds CISSP, CISM, ISO/IEC 42001 Lead Implementer and ISO/IEC 27001 Lead Implementer credentials, with a background spanning KPMG, IBM and Intel/McAfee Foundstone. We led a SaaS virtual data room provider to ISO 42001 certification on its first Stage 2 audit attempt. We help organizations see their real attack surface — and govern the AI running on it.
- Uncover Hidden Subdomains and Expand Your View of the Attack Surface with Subdomains Lookup
- When the Malware Talks to Your SOC: T1685.007 and the Attack on AI Defenders
- Prompt Engineering for Agents: Your System Prompt Is Now Production Code
- US Banks Are Blocking Third-Party AI Agents from Customer Accounts
- Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities
