Request demo

Asset Discovery

Find Every Internet-Facing Asset. Including the Ones Nobody Listed.

Discovery starts from a seed, usually your primary domain, and follows the relationships the index can see: subdomains, the IPs they resolve to, the other domains on those IPs, the domains registered by the same registrant. Your team decides what to keep.

Request demoPlatform guide: Discovered assets

Seedacme.example

Monitored

  • test-api.acme.example

    via passive DNS · 22/tcp · SSH

    Approve

  • campaign24.acme.example

    via certificate transparency · Login page · HTTP 200

    Approve

  • vpn-legacy.acme.example

    via reverse IP · 203.0.113.24 · 3389/tcp · RDP open

    Approve

Ignored

on record, revertible

  • shop-partner.example

    via reverse IP · shared address · shared host, not yours

    Ignore Revert

One Seed Turned Up Three Hosts Nobody Listed.

What one discovery run turns a seed domain into: the subdomains, the addresses behind them and what each one exposes. Three of the hosts were in nobody’s inventory.

  1. Root domain

    acme.example

    IP address

  2. www.

    443/tcp · TLS 1.3

    198.51.100.10

  3. mail.

    MX · SPF record

    198.51.100.12

  4. staging.

    Apache httpd 2.4.49 High

    203.0.113.7

  5. shop.

    PHP 7.4 · end of life High

    198.51.100.77

  6. Asset discovery

    not in inventory · found from the root

  7. campaign24.

    Login page · HTTP 200

    203.0.113.31

  8. test-api.

    22/tcp · SSH

    203.0.113.36

  9. vpn-legacy.

    3389/tcp · RDP open Critical

    203.0.113.24

From One Seed to a Reviewed Inventory.

  1. 01

    Seed

    Add a domain, or a whole list of assets in one API call. Each becomes a starting point.

  2. 02

    Expand

    The engine enumerates subdomains and IPs, then runs reverse lookups against the index to find related domains.

  3. 03

    Review

    Candidates land in a discovery queue. Your team approves them, ignores them, or reverts a decision later.

  4. 04

    Monitor

    Approved assets join the monitored inventory and are scanned layer by layer from then on.

Each Technique Feeds One Review Queue.

The techniques run side by side, share what they find and deduplicate before anything reaches your team.

Forward

Enumeration

Subdomains from passive DNS, certificate transparency and crawling, each resolved to its IP addresses.

Reverse

Pivots Across the Index

Reverse IP, reverse MX, reverse NS and reverse WHOIS against Deepinfo’s own data. If a subsidiary shares your mail servers or registrant, it surfaces.

Rules

Smart and Custom Rules

Deepinfo-maintained smart discovery and monitoring rules, plus custom rules you write as filters over the global domain data. A rule can propose assets or approve them automatically.

The Assets Inventories Usually Miss.

Subsidiary Infrastructure

Domains and hosts owned by group companies and regional entities.

Inherited Assets

Infrastructure that arrived with an acquisition and never made it into the central inventory.

Shadow IT

Campaign domains, sandboxes and tools stood up outside the usual process.

Forgotten Subdomains

Hosts created for one project or event and never switched off.

Pre-Production

Staging, test and development environments reachable from the internet.

Partner-Hosted Services

Services run for you by agencies and partners, under your name.

Discovery You Can Script.

Everything in the queue is available through the EASM API: list candidates, approve or ignore them in bulk with a filter, and turn discovery on for new seeds. One request can approve a whole subsidiary’s domains.

POST https://api.deepinfo.com/v1/easm/discovery/assets/search:approve Reference

Request

curl 
curl -X POST \
  "https://api.deepinfo.com/v1/easm/discovery/assets/search:approve" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @filter.json

Discovery Feeds Everything After It.

EASM Continuous Scanning Approved assets, scanned layer by layer, with history. Read EASM Risk Detection Misconfigurations, exposures and CVEs in one feed. Read EASM Risk Scoring A score per asset and per domain. Read

Query This Data Through the API

The subdomains, DNS records, certificates, ports and technologies this module finds come from Deepinfo’s own index. Your developers can query it through the API.

Questions About Asset Discovery

Are discovered assets monitored automatically?

Only after approval, by your team or by a rule you set to approve automatically. Until then a candidate waits in the discovery queue.

How does discovery avoid proposing hosts that aren’t ours?

It proposes and your team decides. Shared hosting and CDNs put unrelated domains on the same IP addresses, so a candidate found through shared infrastructure waits for review unless a rule you configured approves it.

How do we hear about new candidates?

A notification rule on new_asset_discovered emails the team members you choose when discovery finds an asset, instantly or as an hourly to monthly digest.

Do ignored candidates count toward our scope?

No. Candidates your team ignores are neither monitored nor billed, and the decision stays on record so it can be reverted later.

Can discovery find domains registered behind a privacy service?

Not through the registrant: WHOIS records hidden by a privacy service can’t be matched in a reverse WHOIS search. Such domains can still turn up through shared name servers, mail servers or IP addresses, or be added by hand.

Can we change the rules Deepinfo maintains?

Yes. Your team can tune the smart discovery and smart monitoring rules that Deepinfo maintains, and write custom rules next to them. All of them can be managed through the EASM API too.

Find What’s on Your Surface That You Didn’t Know About.

Book a walk-through on your domain.

Request demo