signalfort · from outside
New subdomains: catch shadow IT early
Staging and “temporary” VPN hosts often appear without security review. We keep inventory and raise a finding when an unknown host shows up.
- ✓Current subdomain inventory
- ✓Alert on a new host
- ✓Tied into stack matching
- ✓No agents on servers
signalfort in numbers
Nothing to install. Enter a domain — and the check starts.
Where shadow IT comes from
Marketing, a vendor, or a “two-day test” expose a host. From outside it is the same entry — often unpatched and untracked.
- —No single subdomain inventory
- —Stands never get turned off
- —New hosts miss SSL monitoring
- —Security finds out last
What we capture
A host change is a full finding in the same lifecycle.
Inventory
Current subdomains and services under the verified root.
New host
Unknown name appears — alert and change record.
Tied to the stack
New hosts go into CVE/BDU matching and HTTPS hygiene.
Notifications
Email, and on Business also webhooks into your tools and AI assistants over MCP.
How to start
Ownership first — then inventory.
- 01
Verify the root
DNS TXT for your domain.
- 02
Wait for inventory
See what is visible from outside.
- 03
Triage what is new
Owner, whether it should face the internet, close or harden.
Radar refreshes weekly; Contour daily
Spreadsheet vs monitoring
Listing subs in Excel vs learning the day they appear.
- Stale in a month
- No alert on new
- Not tied to CVE
- Easy to lose a stand
- 1.Live inventoryby plan
- 2.Change alertnew host
- 3.Straight into analysisstack and SSL
- 4.One dashboardwith every finding
A signal to act
A new subdomain is a task: whose, why, close or not.
Host missing from prior inventory
Owner found; stand closed or hardened
- ·hostname
- ·when it appeared
- ·link to root
Who needs it
Teams with many vendors and fast landing pages.
IT and security
Surface control without walking every DNS zone by hand.
Agencies
Clarity on what is open in the client’s name.
Product / marketing
New storefronts should not be invisible to security.
Plans for the job
Perimeter hygiene is in every plan; frequency and depth differ.
Radar
Free
Passive analysis and weekly hygiene. One domain.
Contour
from ₽1,490/mo
Daily checks, confirmation, fix deadlines and re-check.
Business
from ₽4,490/mo
5 domains, fix deadlines, webhooks and MCP for AI assistants, FSTEC/CRA reports, deep analysis with consent.
Not a full DNS bruteforce
We collect what is visible from open sources and passive discovery under a verified domain — not “bruteforce the whole internet”.
A host disappearing or an IP change is a cue to re-check: taken down or moved.
Why a new subdomain is a finding
Shadow IT often runs without patches and without security ownership. A new host on the same root is another entrance.
The finding gets confidence and the same lifecycle as CVE and SSL — a task to close, not a chat note.
What to do after the alert
Find the owner, decide if it must face the internet, shut down extras, update software and TLS.
If it stays, it joins stack matching and hygiene monitoring with the rest of the perimeter.
Related
SSL and domain monitoring and check a site from outside.
CMS on forgotten stands: Bitrix on the perimeter.
FAQ
Is this a full DNS bruteforce?
No. Only what is visible for a verified domain from open sources and passive discovery.
When do I get an alert?
When inventory gains a host that was not there. Radar weekly; Contour daily.
What should I do with a new subdomain?
Find the owner, decide if it should face the internet, close extras, patch. The finding stays in the shared lifecycle.
Do you scan other people’s domains?
No. Inventory and active checks only after ownership verification.