# Weekly shadow IT hunt for unknown servers on your domains

> Every Wednesday, find internet-facing servers on your domains that are missing from your asset list, ranked by how exposed they are.

- Workflow type: agent
- Services: Shodan, SecurityTrails, Google Sheets, Slack
- Categories: Engineering, Operations
- Published: 2026-08-09

## What it does

- Pulls a fresh picture of every hostname live on your company domains from two independent discovery sources, then merges them so nothing is missed
- Compares that picture against your asset inventory spreadsheet, so you only hear about hostnames that are genuinely new since last week
- Checks what is actually running on each new find, then separates sanctioned company infrastructure from systems nobody told security about
- Adds confirmed new assets to your inventory and posts a Slack rundown ordered by exposure, with open admin logins, databases, and remote access called out first

## What you'll need

- A Shodan account and a SecurityTrails account, which is where the discovery data comes from
- A Google Sheet with two tabs: one listing the root domains your company owns, and one holding your known asset inventory
- A Slack workspace and the channel where the security rundown should be posted

## Prompt

Every Wednesday at 8am, hunt for shadow IT across my company domains. I am looking for internet-facing hostnames that exist on domains we own but are missing from our asset inventory. Use a cron trigger.

Start by reading two things from my Google Sheets asset workbook with Get Values. The first tab lists the root domains my company owns, one per row, and is the definitive scope for this run. The second tab is the known-asset inventory, one hostname per row, and is the reference point for deciding what counts as new.

For each root domain, build the current subdomain picture from two independent sources: SecurityTrails List Subdomains, and Shodan Get Domain Info. Union the two result sets and normalize everything to lowercase fully qualified hostnames before comparing, because the two sources return labels in different shapes. Deliberately use both rather than picking one, since neither sees the whole picture on its own, and a hostname that only one source knows about is exactly the kind of asset that tends to go unmanaged.

Subtract the inventory from that union to get the hostnames that are genuinely new since last week. If the inventory tab is empty on the very first run, say so plainly in the Slack message and treat the whole union as the starting baseline, rather than reporting hundreds of long-standing hosts as urgent findings.

For each new hostname, find out what is actually listening instead of guessing from the name. Call Shodan Resolve Hostnames to get the IP address it points at, then Shodan Get Host Information on that IP to see the open ports, running services, banners, and any known vulnerabilities Shodan has observed. Shodan rate limits to roughly one request per second, so pace these lookups and work through the new hostnames in small batches rather than firing everything at once.

Then make the judgement call this workflow exists for: does each new hostname look like sanctioned infrastructure, or like something nobody told security about? Weigh what is actually running, not just how the hostname is spelled. Strong shadow IT signals include exposed admin panels and login interfaces, databases reachable from the internet, remote access services such as RDP, SSH, and VPN, default or unbranded server pages, self-signed certificates, and hosting that sits outside our normal cloud accounts. Suppress the recurring noise: content delivery network endpoints, wildcard DNS artefacts, and vendor-hosted marketing subdomains pointing at SaaS platforms. Those are expected and should not be reported as findings. Where a host is genuinely ambiguous, include it but say plainly why you are unsure.

Append the confirmed new assets to the inventory tab with Append Values, one row per hostname, capturing the hostname, the root domain it sits under, the resolved IP, the open ports and services observed, your sanctioned or shadow IT judgement, and the date it was first seen. Append rather than overwrite, so the inventory grows into a durable record. Only append hostnames you actually confirmed, so suppressed noise never enters the inventory and quietly becomes a known asset.

Finally, post the rundown to my security Slack channel with Send a Message, ranked by how exposed each discovery is rather than alphabetically or in discovery order. Lead with anything exposing an admin interface, a database, or a remote access service, then everything else, then a short tail noting what was suppressed as noise and why. For each finding give the hostname, what is listening on it, and one line on why it looks like shadow IT. Open the message with a headline count of how many hostnames are new and how many need attention. If nothing new turned up, still post a short all-clear saying the check ran and how many assets are being tracked, so I can tell the difference between a quiet week and a broken automation.

## How to customize

- Change the timing. Wednesday at 8am is the default, but daily or monthly works the same way
- Adjust what counts as expected noise, such as vendor-hosted marketing pages or delivery-network addresses you never want reported
- Decide which services top the priority list, for example admin logins and databases ahead of everything else

## FAQ

### Why does it check two sources instead of one?

No single discovery source sees everything. Two independent sources are merged into one list, so a hostname that only one of them knows about still gets caught. That gap is often exactly where unmanaged systems hide.

### What counts as a new asset?

Anything live on your domains today that is not already listed in your inventory spreadsheet. Because the inventory is the reference point, adding a row there is all it takes to stop hearing about something.

### Will it flag our marketing pages and vendor tools every week?

No. Vendor-hosted marketing subdomains, delivery-network addresses, and wildcard entries are treated as expected noise and suppressed, so the rundown stays short enough to actually read.

### What happens the first time it runs?

If your inventory sheet is empty, everything discovered will look new. Seed the sheet with the assets you already know about first, or expect one large catch-up rundown on the first run and a normal short one every week after.

### Do I need to be technical to read the Slack message?

The rundown is written in plain language and ordered by how exposed each system is, so a manager can skim the top of it while the security team works down the list.

Use this prompt in General Input: https://www.generalinput.com/prompts/weekly-shadow-it-hunt-for-unknown-servers-on-your-domains