Data Points

🌿 Subdomain

A host under a parent domain — often reveals staging, admin, and forgotten infrastructure.

Network

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open Subdomain workbench →Advanced search →Link analysis →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — Subdomain exploitation

Direction — frame the requirement for Subdomain: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Subdomain

A subdomain is a label prefixed to a parent domain (e.g. mail.example.com) that delegates a distinct host, service, or environment. In investigations subdomains expose an organization's attack surface, staging and admin panels, and phishing/lookalike hosts, and they inherit or diverge from the parent's hosting to reveal infrastructure structure.

Format: Dot-separated labels under a registered eTLD+1; each label <=63 chars, LDH rule; full FQDN <=253. Wildcard (*.example.com) and punycode labels valid.

📡 How it is collected

Certificate Transparency SAN enumeration
Passive DNS records
DNS brute-force / wordlist resolution
Search-engine and scraping (site: dorks)
Zone-transfer (AXFR) where misconfigured
VirusTotal / OTX relations

📚 Enrichment & validation sources

crt.sh →SecurityTrails →VirusTotal →URLScan.io →AlienVault OTX →Shodan →Censys →Wayback Machine →

🔗 Pivot to

Domain Name →IP Address →DNS Record →URL →TLS certificate →hosting ASN →CNAME target (takeover) →

🧩 Analysis & hunting techniques

CT-log passive enumeration
DNS brute-force with permutation wordlists
Dangling-CNAME subdomain-takeover detection
Virtual-host / co-hosting analysis
Wildcard-DNS filtering
Service fingerprinting per host
Staging/dev environment discovery
Historical resolution diffing

🔧 Tools

Amass
subfinder
assetfinder
dnsx
puredns
massdns
SecurityTrails
nuclei

⚡ Workbench actions

Enumerate from CT logs
Brute-force with wordlist
Resolve A/AAAA/CNAME
Detect dangling-CNAME takeover
Fingerprint running services
Diff against historical passive DNS
Screenshot live hosts
Map to hosting ASN

📊 Dashboard KPIs

Total subdomains discoveredLive/resolving ratioTakeover-vulnerable countNew subdomains since last scanDistinct hosting IPs/ASNs

📂 Open

Data point profile →DNS audit →Passive DNS →Parent domain profile →Correlate →Link analysis →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook