Subdomain Discovery

The subdomains you don't know about are the ones that will cause the incident you can't explain.

Every client has subdomains that were deployed without a ticket, forgotten after a project ended, or inherited from a predecessor. Aideworks discovers them automatically — learning new subdomain prefixes from SSL certificate SANs and your monitoring activity — so your coverage grows as fast as your clients' infrastructure does.

The subdomains that never made it onto the monitoring spreadsheet

Your monitoring list reflects what you knew about when you set it up — not what actually exists today. These gaps tend to surface at exactly the wrong moment.

The developer's shortcut

test.client.nl was deployed to show a partner an integration prototype. It worked, so they kept using it. Two years later it's handling real payments, has its own Let's Encrypt certificate, and nobody added it to any monitoring list.

The inherited gap

You took over a client from another agency. You received a handover doc listing the main domain and four subdomains. Three months later you discover there are actually eleven — including vpn.client.nl and legacy.client.nl, both internet-facing, neither on your radar.

The SAN gap

An SSL certificate's Subject Alternative Names list exactly which subdomains are live — because each one needed to be explicitly included in the cert. Most monitoring tools check the certificate for expiry. Aideworks reads the SANs and uses them to grow your discovery list.

Coverage that grows with every scan — automatically

Aideworks doesn't just probe a static list. It learns. Every SSL certificate checked, every subdomain you manually add, every scan run — each one potentially reveals a prefix that gets added to the global probe list for all your domains.

Learns from SSL certificate SANs

When Aideworks checks an SSL certificate and finds Subject Alternative Names with unknown prefixes (shop.*, api.*, staging.*), those prefixes are added to the probe list automatically.

Learns from your monitoring activity

When you manually add a new subdomain to monitoring, its prefix is saved and probed across all domains in your account. A prefix discovered for one client benefits all of them.

Prefix intelligence spans your whole account

Prefixes aren't per-domain — they're account-level. A prefix learned from client A gets probed against client B, C and D on the next scan cycle.

New prefixes on every scan

As the probe list grows, every subsequent scan covers more ground. Coverage expands automatically over time without any manual work from your team.

One-click monitors for new discoveries

When a new active subdomain is found, you're notified. From the notification, add SSL, uptime and DNS monitors for the new subdomain in one click — no re-configuration needed.

Auto-discovered prefixes

shop.*SSL SAN · clienta.nl
+ new
api.*SSL SAN · medicaloffice.eu
+ new
staging.*Manual add · retailbrand.nl
+ new
vpn.*SSL SAN · dentalpraktijk.nl
+ new
mail.*SSL SAN · logistics-bv.com
known
cdn.*Manual add · clienta.nl
known
auth.*SSL SAN · medicaloffice.eu
+ new
portal.*Manual add · retailbrand.nl
known

4 new prefixes added this scan

32 prefixes now probed across 14 domains

Discovery + SSL + Uptime

Every discovered subdomain becomes eligible for full monitoring in one click.

Finding a subdomain is only step one. Aideworks makes it easy to immediately put it under SSL certificate monitoring, uptime checks and DNS change detection — right from the discovery notification, without navigating to a separate settings page.

New alert recipients, check intervals and port selections inherit from the root domain by default — so adding a new subdomain monitor takes seconds, not minutes. Your coverage grows as fast as your clients' infrastructure does.

🔍 New subdomain found

shop.clienta.nl

Discovered via SSL SAN · A record resolves · Active

Add monitors

Inherits settings from clienta.nl

Coverage you didn't have to manually configure

The most dangerous subdomains are the ones you didn't know to add. Automatic discovery closes the gap between 'what we're monitoring' and 'what actually exists' — without any manual audit work.

Smarter with every client you add

Prefix learning is account-level. The more domains you monitor, the richer your probe list becomes. An agency with 50 client domains has a materially better discovery capability than one with 5.

No blind spots in the attack surface

Every internet-facing subdomain is a potential security exposure. Subdomain discovery gives you visibility across your entire attack surface — the foundation of any serious monitoring or security posture.

Works best alongside

Start monitoring today

Unlimited domains, manual checks always included. Every domain you add gets a 7-day trial of full automation — no credit card required.