Weekly shadow IT hunt for unknown servers on your domains

Every Wednesday at 8am, hunt for shadow IT across my company domains. I am looking for internet-facing hostnames that exist on domains we own but are missing from our asset inventory. Use a cron trigger.

Start by reading two things from my Google Sheets asset workbook with Get Values. The first tab lists the root domains my company owns, one per row, and is the definitive scope for this run. The second tab is the known-asset inventory, one hostname per row, and is the reference point for deciding what counts as new.

For each root domain, build the current subdomain picture from two independent sources: SecurityTrails List Subdomains, and Shodan Get Domain Info. Union the two result sets and normalize everything to lowercase fully qualified hostnames before comparing, because the two sources return labels in different shapes. Deliberately use both rather than picking one, since neither sees the whole picture on its own, and a hostname that only one source knows about is exactly the kind of asset that tends to go unmanaged.

Subtract the inventory from that union to get the hostnames that are genuinely new since last week. If the inventory tab is empty on the very first run, say so plainly in the Slack message and treat the whole union as the starting baseline, rather than reporting hundreds of long-standing hosts as urgent findings.

For each new hostname, find out what is actually listening instead of guessing from the name. Call Shodan Resolve Hostnames to get the IP address it points at, then Shodan Get Host Information on that IP to see the open ports, running services, banners, and any known vulnerabilities Shodan has observed. Shodan rate limits to roughly one request per second, so pace these lookups and work through the new hostnames in small batches rather than firing everything at once.

Then make the judgement call this workflow exists for: does each new hostname look like sanctioned infrastructure, or like something nobody told security about? Weigh what is actually running, not just how the hostname is spelled. Strong shadow IT signals include exposed admin panels and login interfaces, databases reachable from the internet, remote access services such as RDP, SSH, and VPN, default or unbranded server pages, self-signed certificates, and hosting that sits outside our normal cloud accounts. Suppress the recurring noise: content delivery network endpoints, wildcard DNS artefacts, and vendor-hosted marketing subdomains pointing at SaaS platforms. Those are expected and should not be reported as findings. Where a host is genuinely ambiguous, include it but say plainly why you are unsure.

Append the confirmed new assets to the inventory tab with Append Values, one row per hostname, capturing the hostname, the root domain it sits under, the resolved IP, the open ports and services observed, your sanctioned or shadow IT judgement, and the date it was first seen. Append rather than overwrite, so the inventory grows into a durable record. Only append hostnames you actually confirmed, so suppressed noise never enters the inventory and quietly becomes a known asset.

Finally, post the rundown to my security Slack channel with Send a Message, ranked by how exposed each discovery is rather than alphabetically or in discovery order. Lead with anything exposing an admin interface, a database, or a remote access service, then everything else, then a short tail noting what was suppressed as noise and why. For each finding give the hostname, what is listening on it, and one line on why it looks like shadow IT. Open the message with a headline count of how many hostnames are new and how many need attention. If nothing new turned up, still post a short all-clear saying the check ran and how many assets are being tracked, so I can tell the difference between a quiet week and a broken automation.