What is a Subdomain? How to Find and Monitor Forgotten Alt Domains
In the domain name system (DNS) hierarchy, a subdomain is a prefix added to a root domain name to organize or route traffic to different sections of a website (e.g., app.yourcompany.com or blog.yourcompany.com).
---
The Danger of Subdomain Leakage
While subdomains are incredibly useful, they also pose security risks when left unmonitored:
* Dev/Staging Exposures: Developers frequently host staging servers on subdomains. These often run in debug mode, exposing API keys, source code, or unpatched vulnerabilities.
* Leakage of Internal Architecture: Subdomain names like internal-gitlab.company.com give attackers a clear map of your company's internal software assets.
---
How to Discover Forgotten Subdomains
Cybersecurity professionals use two primary techniques for subdomain discovery:
1. Passive Discovery Searching public databases, Certificate Transparency (CT) logs, and search engines. Since SSL certificates are logged publicly in CT logs, searching these logs yields a list of subdomains without sending any traffic to the target.
2. Active Discovery (Brute-Forcing)
Sending DNS queries for a large list of common words (e.g., vpn, dev, mail) to see which ones resolve.
---
Continuous Subdomain Monitoring with Mangudai
Finding your subdomains once is not enough. You need to know when a developer creates a new alt domain or when an old one goes offline. Mangudai automatically checks CT logs and monitors your DNS footprint daily.
Secure Your Perimeter Today
Identify your exposed assets, subdomains, open ports, and SSL vulnerabilities before malicious actors find them.
Check Your Domain for Free