A hostname is a clue
A subdomain can point to an application, a vendor-hosted service or a retired project. Its presence alone does not establish ownership or risk; both need verification.
Map relationships carefully
Use authorized sources such as DNS, certificate transparency records and your own inventories. Link each discovered name to an owner and purpose where possible.
Review what changed
Compare hostname inventories over time and investigate additions, removals or unexpected destinations. This helps keep the asset record aligned with actual deployments.
Put the guidance into practice
ASWEEP helps frame an authorized external assessment around asset visibility, exposure review and actionable reporting. Discuss your scope and goals before deciding which methods are appropriate.
Request a Security AssessmentFurther reading
For technical guidance, see the OWASP Web Security Testing Guide and CISA security resources. These external resources are provided for context.