External attack surface assessment

Malicious lookalike domains detectedNeeds a licence key

A registered lookalike domain that is also flagged by threat intelligence indicates an active phishing or impersonation campaign against this brand

How to fix it: Review the listed lookalikes: first confirm whether any are your own defensive registrations. For confirmed third-party phishing infrastructure, file abuse reports with the registrar (WHOIS) and the hosting provider, and submit takedown requests to URLhaus and Google Safe Browsing. Defensively register the highest-risk permutations you don't already own.

Extensive subdomain exposure: 100+ subdomains

Large numbers of subdomains increase attack surface area

How to fix it: Run a subdomain inventory exercise: list every hostname, owner, hosting provider, and last-deployed date. Decommission anything inactive over 90 days, harden the rest with TLS / HSTS / CSP, and set up monitoring that alerts on net-new subdomains (Censys, your own DNS walker, or a CT-log monitor).

Domain registered very recently

Very young domains (< 30 days) are disproportionately used for short-lived phishing and fraud campaigns

How to fix it: Domain age is immutable, but its risk impact decays over time. For underwriting, treat as a temporary risk premium that fades over the first 12 months. For operators, accelerate trust signals: publish security.txt, harden TLS / DMARC / DNSSEC, list the entity in standard business directories, and document corporate registration so partners and customers can verify authenticity.

Large attack surface: 50+ subdomains

Fifty or more subdomains. At this size an inventory almost certainly does not exist, and hostnames outlive the projects that created them.

How to fix it: Automate the inventory rather than compiling one by hand, and monitor CT logs for new certificates so additions are noticed. Audit for dangling DNS entries, then establish a decommissioning process that removes DNS records, not just servers.

Many open ports detectedNeeds a licence key

More than ten non-web services are exposed. This usually indicates a host that grew organically without a firewall policy, rather than a deliberate configuration.

How to fix it: Start from default-deny rather than auditing port by port: block everything at the firewall, then open only what is demonstrably needed. Verify from outside your network afterwards: cloud security groups and host firewalls disagree more often than people expect.

Moderate attack surface: 20+ subdomains

Twenty or more subdomains. Not excessive, but past the point where an inventory is optional: every hostname is a service someone has to keep patched.

How to fix it: Produce an inventory and give each hostname an owner. Check specifically for dangling DNS records pointing at services you no longer run: subdomain takeover is trivially exploitable and easy to find. Remove records for anything decommissioned.

Multiple open portsNeeds a licence key

More than five non-web services are reachable from the internet. Each is separate software with its own vulnerabilities and its own authentication.

How to fix it: For each port, decide whether it genuinely needs to be internet-reachable. Databases, SSH and admin panels almost never do: put them behind a VPN or restrict them by source address. Where a service must stay public, ensure it is patched, authenticated and rate-limited.

Many registered lookalike domains

A large number of registered lookalike domains expands the brand attack surface even when none are individually flagged today

How to fix it: Audit the listed lookalikes against your defensive-registration inventory. For permutations not owned by you, set up periodic monitoring (these often go live with phishing months after registration); consider acquiring high-similarity domains or filing UDRP complaints for confusable trademarks.

Domain registered within last 6 months

Recently registered domains (1-6 months) carry elevated risk before establishing operational history

How to fix it: Same guidance as for very-new domains with a smaller risk weight. Continue normal operation; the signal will fade as the domain accumulates history. Tightening TLS, DMARC, and DNSSEC has the biggest near-term effect on perceived legitimacy.

Domain registered within last year

Domains under one year old have not yet established long-term trust signals

How to fix it: Low-priority. Maintain strong security hygiene during the first year so this signal converts cleanly to neutral as the domain matures.

Some registered lookalike domains

A small number of registered lookalikes are common for any well-known domain and represent latent brand-abuse risk

How to fix it: Spot-check the listed lookalikes via WHOIS to identify ownership. Register obvious gaps in your defensive portfolio: single-character omissions of the primary brand are the cheapest insurance against future phishing.

No WHOIS data available

No WHOIS data was available: typically a ccTLD without OTX coverage, or a domain with extreme privacy protection

How to fix it: No action required: informational. Confidence in domain-age signals is reduced for this run, not a finding against the domain itself.

High-Risk subdomains detected

Patterns like "admin", "test", "dev" are commonly targeted

How to fix it: Move admin., dev., staging., test., phpmyadmin., cpanel. and similar behind a VPN, SSO, or IP allowlist. If they must remain public-facing, enforce strong auth (FIDO2/WebAuthn), aggressive rate-limiting, and confirm they run currently-patched software: never expose phpMyAdmin or cPanel without authentication on the public web.