Ask anyone what their organisation has on the internet and you will get the main domain. Ask what else and the answers get vague: a staging site from a redesign, a remote-access gateway from before the VPN, a subdomain a contractor pointed at a cloud service in 2019.
None of that is negligence. It is what happens when infrastructure outlives the person who set it up. The problem is that an attacker does not start with your main domain — they start with everything else, because the least-maintained thing you own is the easiest way in.
The check costs five credits, the deep sweep ten, and neither needs proof of ownership: it reads public DNS and public certificate transparency logs.
The dangling ones
The finding worth acting on fastest is a subdomain still pointing at a cloud service nobody pays for any more.
The mechanism is simple. You pointed docs.example.com at a hosting provider. Later the account lapsed, but the DNS record stayed. The provider has since freed that hostname — so anyone can now claim it and serve whatever they like from a subdomain of yours, with a valid certificate, on a name your customers trust. That is a subdomain takeover, and it needs no access to your systems at all.
The filtering service you are paying to bypass
The check also establishes whether a domain is served through a filtering or CDN service, and then names the hosts answering on their own address around it.
If your main site sits behind a WAF but the origin server also answers directly on its own IP, an attacker skips the protection entirely. You are paying for filtering that a single direct connection walks around.
Two deliberate limits keep this honest. Hosts that could never sit behind such a service are excluded rather than reported as bypasses. And where the published address data is missing or too stale to rely on, the check makes no claim at all — because accusing someone of exposing their origin on the strength of a stale record is worse than saying nothing.
What the deep sweep adds
A far wider list of candidate names, one level deeper than the domain itself, each host's icon read to identify the software behind it, and a further method of recognising the filtering service in front of a host.
Why this is the foundation of the rest
Every other check needs to know what to look at. A TLS check on your main domain tells you nothing about the forgotten gateway with a certificate that expired last spring. Discovery is what turns "our website" into an inventory — which is the whole of external attack surface management, and the reason it comes first.
Every new account gets free starter credits. Start at app.clickscan.ai, or see everything ClickScan checks.