This guide outlines five critical DNS threat management techniques—subdomain enumeration, expired certificate detection, open directory scanning, favicon searches, and unauthorized email server monitoring—using advanced tools like Silent Push to safeguard your organization’s digital footprint.
Enumerate subdomains
Subdomains are prime targets for cybercriminals who exploit misconfigurations to launch impersonation campaigns or subdomain takeovers. Mapping your subdomain landscape provides a top-down view of your public DNS presence, helping you identify vulnerabilities.
Navigate to Attack Surface Mapping > Digital Footprint for Domain > Subdomain Finder.
Enter a domain (e.g., example.com).
Specify a Sorting Order (e.g., alphabetical or by date).
Click Search to list all subdomains and trusted infrastructure.
To monitor changes, click Monitor on the Explore screen, specify a Monitor Name and Description, and save. Monitors run every 24 hours, sending email alerts for new results.
Locate expired certificates to maintain trust
Expired SSL certificates can disrupt secure transactions, cause website downtime, and damage your brand’s reputation. Worse, threat actors create fake certificates mimicking your brand to host malicious content.
Navigate to Advanced Query Builder > IPv4 Queries > Scan Data - Certificates.
Enter an IPv4 address and an optional netmask to scan a range.
Specify a certificate fingerprint or domain name (wildcards supported).
Check Expired Certs Only and set a time window (e.g., 30 days).
Limit results and click Search.
Scan for open directories to secure data
Open directories—publicly accessible file folders on webservers—can expose sensitive data like configuration files or phishing kits if not properly secured.
Navigate to Advanced Query Builder > IPv4 Queries > Scan Data - Open Directories.
Enter an IPv4 address and an optional netmask to scan a range.
Use the filename field (wildcards supported) to search for phishing kits or malicious files.
Set a time window for scan results.
Optionally, click Copy API URL to integrate with your security stack or Save Query to store parameters for later use.
Favicon searches to detect fake websites
Favicons—small icons in browser address bars or tabs—are often replicated by attackers to make fake websites appear legitimate, tricking users into sharing credentials or downloading malware.
Navigate to Advanced Query Builder > IPv4 Queries > Scan Data - Favicon.
Enter an IPv4 address and optional netmask.
Specify whether the IP is “In” or “Not In” a subnet.
Provide an MD5 or MurmurHash, or calculate an mmh3 hash from a URL.
Limit results and click Search.
Optionally, click Copy Raw Data or Copy API URL for integration, or Save Query for future use.
Scan for unauthorized email servers
Unauthorized TXT records can enable email spoofing, allowing attackers to bypass authentication protocols like DKIM and DMARC, often in business email compromise (BEC) scams.
Navigate to Attack Surface Mapping > Name in TXT Record > Create New.
Enter your domain name.
Specify a “Last Seen” period and optional sorting order.
Click Search to locate TXT records associated with your domain.
Regular audits, employee training, and customer education are critical to staying ahead. Protect your organization’s reputation and revenue—start securing your DNS infrastructure today.