Before attacking anyone, you look at them from a distance. Passive recon takes no packets, breaks no laws, and tells an attacker most of what they need. I run the same tricks on my own stuff every few months, because what I find is usually a service I forgot existed. Here is the tour, from the attacker's seat, then from yours.

Subdomains: the map you published yourself

Your DNS records are public. A wordlist of common names against your domain finds the staging server, the VPN endpoint, the admin panel — everything you thought was hidden by not linking to it.

subfinder -d example.com -silent | httpx -silent -status-code | head -20

That is the entire attack, and it takes ten seconds. Your defense is publishing only what needs to exist. Wildcards do not hide anything; they just make the guessing cheaper.

Certificate logs: the inventory you never made

Every TLS certificate issued for your domains is logged publicly, forever. If a hostname ever got a public certificate — even for a test, even for a week — it is in the log:

curl -s "https://crt.sh/?q=%25.example.com&output=json"   | jq -r '.[].name_value' | sort -u

Anything in that list that should not be public knowledge is a finding. Internal names belong on an internal CA or a mesh, not on a public certificate.

Shodan already knows your versions

Within hours of exposing a service, it is indexed with its banner — software and version included. An attacker does not scan you; they query Shodan:

shodan search --fields ip_str,port,product "net:203.0.113.0/24"
shodan host 203.0.113.10

Run the same query on your own ranges. The service you forgot you exposed will be in the results, waiting.

Code search: the leak that is not a breach

Most credentials that leak do not leak from a hack. They sit in a public repository, a paste, a config gist:

site:github.com "example.com" "aws_access_key_id"
site:pastebin.com "example.com"

When you find one — and you will — the fix is not deleting the file. It is rotating the credential. Anything that touched a public repo is compromised, git history included.

There is no hiding from passive recon. There is only deciding what it finds. Fewer public services, fewer records, fewer certificates, and the attacker's ten minutes turn up nothing worth ten minutes.