Digital footprinting has become a must for any organization, especially now that experts say that getting affected by threats is no longer a matter of if but when. At times, companies’ reputations get dragged in the mud because threat actors hijack their insufficiently protected subdomains and use these to attack their customers, partners, and stakeholders.
Constantly monitoring the security of one’s domain infrastructure using a subdomain lookup tool is helpful in such cases. This post explores the various use cases of subdomain lookups, particularly for cybersecurity and threat detection efforts.
Conduct a Complete Audit of an Organization’s Subdomains
While subdomains help organize a corporate website, leaving them online when they are no longer in use can leave networks susceptible to threats. Subdomain takeovers often stem from forgotten web properties, allowing hackers to take control and plant malware into systems and applications.
In that sense, a subdomain lookup tool can help you manage this part of your cybersecurity, as it is useful for taking stock of all your company’s Internet-facing infrastructure. But just how many subdomains do large companies have? A subdomain lookup for most Fortune 500 companies would likely show hundreds, if not thousands, of subdomains for the company-owned root domain. Ensuring that all of these subdomains are under companies’ control is one way to lessen the chances that any of them could be used to target employees, customers, suppliers, and other stakeholders.
Yet that may not be enough. It is common to see many other root domains that contain branded strings, such as company names and key product identifiers, but do not necessarily have much to do with the organization in question. For brand protection purposes, it is, therefore, also important to identify all of the subdomains that contain such terms.
Following that, cybersecurity and brand protection specialists need to see if the ownership details of the identified subdomains’ root domains are the same as those identified in the company-owned domain’s WHOIS record. As Fortune 500 companies often keep their WHOIS records public, any subdomain with a root domain that doesn’t have matching details warrant investigation.
Determine Who Owns a Subdomain That May Be Exploiting a Brand’s Popularity
Once you have found subdomains containing branded terms but with divergent root domains’ WHOIS records, the next step is to attribute ownership. Could these root domains pertain to threat actors? Or are some legitimate domain owners possibly victims as well?
Either way, phishers are known for impersonating popular brands for their campaigns. Many security companies, magazines, and news sites regularly publish a list of the most-spoofed brands to warn Internet users about links that could cause them to lose their personal data to threat actors. In 2020, one of the top brands on phishers’ lists was Microsoft. That’s not surprising, of course, since Windows continues to be the most used desktop operating system (OS) worldwide. It is also a Fortune 500 company and employs millions of people the world over, making it a very attractive attack target.
As a result, there are often cases where “microsoft” as a string would appear in subdomains where the associated root domains are not owned by the company. Instead, threat actors may have purposefully registered the root domains with, most often than not, redacted WHOIS records. Or threat actors may have found a way to interfere with the domains owned by legitimate registrants and add branded subdomains without being detected. This latter approach is advantageous to attackers since they can carry out their campaigns from established and trusted domains that would not be easily flagged as suspicious.
—
Domain and subdomain footprinting lets an organization learn how attackers can abuse its exposed and insufficiently protected digital assets. Like business owners, cyber attackers conduct domain footprinting as part of their reconnaissance to ensure their malicious campaigns’ success. To keep up, companies need to do the same.