How do subdomains get discovered by adversaries?

[raf]

On Thu, Dec 22, 2022 at 07:16:55AM +0000, Michael De Roover <isc at nixmagic.com> wrote:

> So PTR records don't seem to be very useful in getting this information
> either. As such, I am still stranded.

Unless you scan for all (IPv4) PTR records into a
database ready for searches.

Here's a link to a page that lists several tools for
finding subdomains. At least one of them maintains a
large database of domain names. But there are probably
various ways. There seems to be a lot of different
tools for this. You could check out each tool and see
what they say they do.

  https://geekflare.com/find-subdomains/

> Thanks again for your attention,
> Michael

cheers,
raf