Weekly check for new websites and servers on your domains

Every Monday at 8am, watch my company's external attack surface for changes and tell me what is new since last week.

Start by reading my list of owned root domains from my Google Sheets tracker using Get Values. The first tab holds one root domain per row. Treat that tab as the definitive list of what we own, so adding a row there is all anyone has to do to bring a new domain into scope.

For each root domain, call SecurityTrails List Subdomains to pull the current set of hostnames, then call SecurityTrails Get Domain to pull the DNS records for the hosts you found. Assemble this into a current snapshot: one row per hostname, with the root domain it belongs to, the addresses it currently resolves to, and the date of this run.

Then read the previous week's snapshot from the second tab of the same sheet with Get Values, and diff the two. The comparison is the whole point of the workflow: I want to hear about hosts that appeared since last week, hosts that disappeared, and hosts that were already known but have started resolving somewhere different.

After the diff, write the fresh snapshot back to that second tab with Update Values so next week has a clean baseline. Do this on every run, including runs where nothing changed, because a missed write silently breaks the following week's comparison. On the very first run the snapshot tab will be empty, so there is nothing to compare against: save the baseline, post a short note in Slack saying the baseline was established, and do not open any Jira issues that run.

For anything newly appeared, judge which hosts actually matter rather than treating every new name as equally urgent. Flag hostnames that suggest unmanaged or pre-production infrastructure, such as dev, staging, test, uat, qa, admin, vpn, jenkins, git, jira, backup, or old. Also flag when a host has newly started resolving to a cloud provider IP range, which often means someone stood up infrastructure outside the normal process. Hosts that look like routine marketing pages or expected additions should be mentioned but not escalated.

Post a short written briefing of the week's changes to my security Slack channel with Send a Message. Lead with the headline count of new hosts and how many are high priority, then list the new hosts with what they resolve to and a one-line reason each one was or was not flagged, then briefly note anything that disappeared or changed address. Write it in plain language a manager can skim, not a raw data dump.

Open one Jira issue with Create Issue per high-priority new host so the security team has something concrete to work. Give each issue a summary naming the hostname, and a description covering the root domain it sits under, what it resolves to, why it was flagged as high priority, and the date it was first seen. One issue per host, never a single combined ticket, and never an issue for a host that was already reported in a previous week.

If nothing changed at all, still post a brief all-clear to Slack saying the check ran, how many hosts are being tracked across how many domains, and that there were no changes. I would rather see a quiet confirmation every week than wonder whether the automation is still alive.