Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
Critical
Example scenario
Exposed admin panel on a forgotten subdomain
A subdomain left running after a marketing campaign ended stayed up on an outdated CMS version, with its panel exposed to the internet.
- Case no
- IG-UC-2026-004
- Threat
- A subdomain created for an old campaign was serving an admin panel with no authentication.
- Sectors
- E-commerce, Telecommunications, Defence
- Roles
- SOC Analyst, IT Operations
- Outcome
- The subdomain was decommissioned and inventory ownership assigned to IT operations.
The InsightGuard approach
The attack surface scan inventoried the subdomain, fingerprinted the running technology and matched it to known CVEs.
Timeline
Situation → Outcome
-
Campaign subdomain
A separate subdomain and CMS install are provisioned for the campaign.
-
Left unowned
The campaign ends, the record is never removed and the CMS stops receiving updates.
-
Inventory and fingerprint
The scan finds the subdomain and detects the panel path and version.
-
Decommission
The DNS record is removed, the server shut down and content archived.
-
Process fix
Ownership and an expiry date become mandatory for campaign subdomains.
Related files
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.