Skip to content

DNSSubdomains and lookalikes

Every name that points at you, and the ones pretending to.

Old subdomains keep resolving long after the project ends, and a DNS record pointing at a deleted cloud resource is an open invitation: whoever claims that resource name next inherits a hostname under your domain. Meanwhile, someone is registering the version of your domain with two letters swapped. Nulink enumerates every subdomain, resolves every record to see whether its target still exists, and watches the registries for names built to be mistaken for yours.

Book a demoOpen the platform

What it finds

  • Forgotten staging, test, demo and campaign subdomains still resolving years later
  • Dangling CNAME and A records pointing at cloud resources that no longer exist
  • Typosquats, homoglyphs, hyphenation tricks and alternative TLDs registered against your brand
  • Which lookalikes have MX records, and can therefore send mail that appears to come from you
  • Where each lookalike is registered and hosted, and whether a live site is already running on it
  • Subdomains whose certificates have expired or are about to

Where the data comes from

  • Certificate transparency logs
  • Passive DNS
  • Brute-force resolution
  • WHOIS / RDAP
  • GeoIP

How it works

  1. 01

    Enumerate

    Nulink builds the full list of subdomains under each verified domain from logs, passive DNS and resolution.

  2. 02

    Resolve

    Every record is checked to confirm it still points at something that exists and is yours.

  3. 03

    Watch registrations

    Impersonation patterns against your domains are generated and checked against the registries for live matches.

  4. 04

    Alert

    You are told when a record starts dangling, when a lookalike is registered and when one gains mail servers.

In detail

Why dangling records are urgent
When a cloud resource is deleted and the DNS record pointing at it is not, anyone who can claim that resource name inherits a hostname under your domain, complete with the trust your users place in it. Nulink resolves every record and flags the ones whose target has stopped answering, with the failed response as evidence.
A lookalike with MX is a different animal
A typosquat sitting on a registrar's holding page is a nuisance you can monitor. A typosquat with mail servers configured is a phishing campaign in its final week of preparation. Nulink tells you which of the two you are looking at, so you can escalate the one that matters.
Everything a takedown needs
Each lookalike comes with its registration record and its hosting location, which is exactly what a registrar complaint or a takedown request has to contain. You are not starting the paperwork from a hostname and a hunch.
Watched, not sampled
New certificates and new registrations are picked up on every scan, so a name that appeared last Tuesday shows up as a change rather than as a surprise during next year's assessment.

What changes for your team

Takeover prevention

Remove a dangling record before someone else claims the resource behind it. This is the cheapest serious fix in security.

Earlier phishing warnings

Spot an impersonation domain while it is still being set up, not when your customers start forwarding you the emails.

A DNS zone you can defend

Retire the names you no longer need. Every one you remove is one fewer thing to monitor forever.

Especially useful for FinTech.

What it doesn't do

Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.

  • Nulink reports lookalike domains and the evidence behind them. It does not file takedowns or contact registrars on your behalf.
  • Takeover risk is reported from the DNS record and the state of its target. Nulink does not claim the resource to prove the point.

Questions about Subdomains and lookalikes

Do you actually take over a dangling record to confirm it?

No. That would mean registering resources in other people's clouds to prove a point about yours. The evidence on the finding is the DNS record itself and the response its target gave, which is enough to act on and nothing you have to clean up afterwards.

Which lookalike variations do you check?

The patterns impersonation actually uses: character swaps, insertions and omissions, homoglyphs that render almost identically, hyphenation, doubled letters and alternative TLDs. Nulink generates them from your verified domains and checks which ones are registered, hosted or configured for mail.

We have thousands of subdomains. Is that a problem?

It is common, and it is the reason to do this. Findings are ranked by severity rather than listed alphabetically, so a dangling record on a forgotten host outranks a cosmetic issue on your main site.

More in Nulink Exposure Management

See all capabilities

Visibility is security. Start with yours.

Book a 30-minute walkthrough with the team, or connect your first account and see results today.

Book a demoOpen the platform