> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain & Subdomain Discovery: Full Web Footprint Map

> How Leverage Cyber maps every domain, subdomain, cloud-hosted property, and acquired web asset tied to your organization's external footprint.

Domains and subdomains are the most visible layer of your external attack surface, and they grow faster than most security teams can track. Every acquisition adds a new set of domains. Every developer who spins up a cloud environment creates a new DNS entry. Every CDN configuration and SaaS integration generates hostnames that resolve to infrastructure you may no longer actively manage. Forgotten subdomains pointing to decommissioned services, orphaned cloud storage buckets still referenced in DNS, and acquired company domains running on unpatched stacks are some of the most exploited entry points in external attacks. Leverage Cyber maps your complete domain footprint from an attacker's vantage point — no credentials, no agents, no scanning required.

## What Gets Discovered

Leverage Cyber uses passive DNS enumeration, certificate transparency log analysis, and internet-wide dataset correlation to discover every asset associated with your organization. Discovery covers:

* **Primary domains** registered directly under your organization's name and brand identifiers
* **Subdomains**, including wildcard entries, delegated DNS zones, and deeply nested hostnames that rarely appear in internal inventories
* **Cloud-hosted properties** such as Amazon S3 buckets, Azure Blob Storage endpoints, CloudFront distributions, and CDN-fronted origins that carry your domain name or are referenced from your primary domains
* **Acquired and subsidiary domains** from past M\&A activity, including domains that were part of the deal but never fully integrated into your security program
* **Expired-but-still-referenced assets** — domains or subdomains whose original destination is gone but whose DNS records remain live, often pointing into the void or to infrastructure that can be claimed by a third party

The result is a comprehensive asset inventory built entirely from public data sources, reflecting exactly what an attacker would enumerate during reconnaissance.

## Common Findings

<Accordion title="Orphaned subdomains pointing to decommissioned services">
  When a service is decommissioned, its subdomain is frequently left in DNS long after the underlying infrastructure is removed. These orphaned entries are low-effort wins for attackers: the hostname still resolves or attempts to resolve, the organization still considers it "theirs," but no one is monitoring it or maintaining it. Common examples include subdomains that once pointed to a legacy application server, a retired marketing campaign microsite, or a vendor integration that was replaced years ago.
</Accordion>

<Accordion title="Subdomain takeover risk (dangling CNAME)">
  A dangling CNAME occurs when a subdomain's DNS record points to a cloud resource — typically a service on AWS, Azure, GitHub Pages, Heroku, or a similar platform — that has been deleted or allowed to expire. Because the CNAME still resolves, an attacker can register that cloud resource under their own account and begin serving content from your subdomain. This content can be a convincing phishing page, a malware download, or a cookie-stealing redirect — all hosted at an address your users and security tools inherently trust. Subdomain takeover is one of the highest-severity findings Leverage Cyber surfaces.
</Accordion>

<Accordion title="Exposed development and staging environments">
  Development, staging, QA, and integration environments are routinely left internet-accessible long after their intended purpose is complete. These environments frequently run older software versions, use default or shared credentials, and contain copies of production data used for testing. Because they are not listed anywhere publicly, organizations assume they are obscure enough to be safe. Certificate transparency logs and passive DNS data make them trivially discoverable. Leverage Cyber identifies these environments and flags them by environment type, hosting provider, and associated risk.
</Accordion>

<Accordion title="Domains from past acquisitions not yet secured">
  Acquisitions create immediate attack surface expansion. The acquired company's domains carry their own DNS history, hosting configurations, email security posture, and credential exposure history — none of which is automatically inherited by the acquirer's security program. Leverage Cyber identifies all domains attributable to acquired entities and assesses them using the same methodology applied to your primary domain, surfacing gaps that exist specifically because the acquisition was not fully integrated from a security standpoint.
</Accordion>

## Reading Your Domain Report

Each entry in your domain report includes the following fields:

| Field                | Description                                                                                                                                         |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Domain**           | The fully qualified domain name (FQDN) as discovered, e.g., `legacy-app.yourdomain.com`                                                             |
| **IP Resolution**    | The IP address the domain currently resolves to, or `NXDOMAIN` if resolution fails                                                                  |
| **Hosting Provider** | The organization that owns the IP range or the cloud service identified from the DNS record type                                                    |
| **Last Seen Date**   | The most recent date this hostname was observed active in passive DNS or certificate transparency data                                              |
| **Risk Flag**        | The specific risk condition identified: `Dangling CNAME`, `Orphaned Record`, `Exposed Dev Environment`, `Acquisition Domain`, or `No Risk Detected` |

Findings are sorted by risk severity. Any domain carrying a `Dangling CNAME` or `Exposed Dev Environment` flag requires immediate attention and appears at the top of your prioritized remediation roadmap.

<Warning>
  **Subdomain takeover is an active, exploited attack technique.** If a CNAME record on your domain points to a cloud resource that is no longer claimed by your organization — such as a deleted S3 bucket, an expired Heroku app, or a deprovisioned Azure endpoint — an attacker can register that resource under their own account in minutes. Once registered, they can serve arbitrary content from your subdomain, including phishing pages and malware, with no indication to the visitor that anything is wrong. If Leverage Cyber flags a dangling CNAME in your report, treat it as an urgent remediation item and remove or update the DNS record immediately.
</Warning>