Skip to content

ASMAsset discovery

Your attack surface, as the internet sees it.

Attackers don't start with your asset register; they start with your domain. Nulink does the same. Verify a root domain and six discovery techniques run outward from it: certificate transparency, passive DNS, brute-force resolution, crawling of the sites already found, mining of web archives, and passive OSINT. What comes back is an external inventory, enriched with hosting, location and registration detail, that you can hold up against what you think you run.

Book a demoOpen the platform

What it finds

  • Subdomains from certificate transparency logs, passive DNS sources and brute-force resolution
  • Further hosts, pages and endpoints reached by crawling the sites already discovered
  • Forgotten pages and URLs recovered from web archives long after they left the live site
  • IP addresses, the providers hosting them and where in the world each one answers from
  • WHOIS and RDAP registration detail for every domain, including registrar and expiry dates
  • Web applications, APIs, login pages and admin panels
  • Assets that exist on the internet but not in your own inventory

Where the data comes from

  • Certificate transparency logs
  • Passive DNS
  • Brute-force resolution
  • Web crawling
  • Web archives
  • theHarvester OSINT
  • WHOIS / RDAP
  • GeoIP

How it works

  1. 01

    Verify

    Add a root domain and publish the TXT record Nulink gives you. Only verified domains are scanned.

  2. 02

    Expand

    Certificate transparency, passive DNS, brute-force resolution, crawling, archive mining and passive OSINT turn one seed into a host list.

  3. 03

    Enrich

    Every host picks up an address, a hosting provider, a location, registration detail and the technologies behind it.

  4. 04

    Compare

    Hold the result up against your own inventory. Whatever is left over is the part you did not know about.

In detail

Six ways in, not one
Certificate transparency catches a name the moment it gets a certificate. Passive DNS remembers names that have resolved before. Brute-force resolution catches the ones that never appear anywhere public. Crawling, archive mining and OSINT pick up what all three miss. Any single technique leaves gaps; the overlap is the point.
Every address on a map
GeoIP places each address, so it is obvious at a glance when a host you believed was in Frankfurt is answering from somewhere else entirely, or when a brand domain is served from a provider you have no account with.
Registration detail attached
WHOIS and RDAP records sit on the domain itself: registrar, registrant, creation and expiry dates. A domain quietly approaching expiry is an exposure too, and it is the kind nobody owns until the week it lapses.
A graph, not a spreadsheet
Assets and findings are explorable as a relationship graph. This certificate covers these hostnames, which resolve to this address, which answers on these ports, which carries this finding. Following the chain is how you work out what a single asset is actually worth fixing.

What changes for your team

An honest inventory

See what is actually exposed, not what the spreadsheet says was decommissioned in March.

The attacker's starting point

Work the same list they would work, before they get round to working it.

Minutes to start

One DNS record and no software. There is no deployment project between you and your first result.

Especially useful for SaaS and MSPs.

What it doesn't do

Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.

  • Discovery works outward from your verified domains. An asset with no DNS or certificate relationship to them will not be found.
  • Nulink does not log in, submit forms or crawl behind authentication.

Questions about Asset discovery

How long does the first scan take?

Discovery starts the moment the TXT record resolves. Results populate as each module completes rather than arriving all at once, so the asset list fills in first and the deeper analysis follows behind it.

Can we add a domain we don't own, like a supplier's?

No. Every root domain needs its own verification record in its own zone, which means you need control of the DNS to put it in scope. If you want a supplier assessed, they verify their domain on their own account.

What if discovery turns up something that isn't ours?

Mark it reviewed. Findings carry a lifecycle status of open, reviewed or resolved, so anything you have looked at and decided is not yours stops crowding the list of things that are.

More in Nulink Exposure Management

See all capabilities

Visibility is security. Start with yours.

Book a 30-minute walkthrough with the team, or connect your first account and see results today.

Book a demoOpen the platform