What can hackers see about your business before they attack?

Here's a scenario that plays out often enough to be a pattern, not a one-off: a business owner receives a very convincing phishing email appearing to come from their own domain, sent to one of their clients. The client almost pays a fraudulent invoice. The attack required no hacking in the traditional sense — the attacker simply looked up the business's domain, confirmed there was no DMARC enforcement, and started sending. Everything they needed was publicly available before they sent a single email.

Most people picture hacking as a dramatic breach of security systems. The reality is that the most effective attacks start with reconnaissance — gathering information that's already public before deciding whether and how to proceed. Here is what that picture looks like.

Your email setup tells attackers whether impersonation will work

The first thing an attacker checks for most businesses is email authentication. A DNS lookup on your domain takes seconds and reveals whether you have SPF, DKIM, and DMARC records, and critically, whether your DMARC policy is set to actually enforce anything.

A domain with no DMARC record, or one set to p=none, is a domain that can be impersonated freely. Emails sent pretending to be from your address will be delivered to recipients without any authentication failure. This is the intelligence an attacker needs before running a business email compromise attack targeting your clients or suppliers.

Your subdomains reveal forgotten assets

Certificate transparency logs are public databases maintained by browser vendors to record every SSL certificate ever issued. They're searchable by domain and reveal every subdomain that has ever had a certificate — including staging environments, old client portals, internal tools that were briefly internet-facing, and subdomains for services the business stopped using years ago.

Each of these is a potential entry point. A subdomain pointing to a cancelled cloud service is vulnerable to takeover. A staging environment with weaker security controls than production is an easier target than the main site. An internal tool accidentally left internet-facing is access that was never meant to be public.

Open ports show what services are running

Scanning tools that probe IP addresses for open ports are freely available and used constantly across the internet. An open port that shouldn't be public — a database accepting connections, an admin panel reachable without a VPN, a remote desktop service exposed to the internet — is something an automated scan will find and a human attacker will investigate.

The information from port scanning combined with service fingerprinting tells an attacker which software is running, often including version numbers, which maps directly to known vulnerabilities in public databases.

Your website configuration signals whether you've been hardened

HTTP response headers are sent by your web server every time someone visits your site. They're visible to anyone who opens browser developer tools or runs a basic check, and they reveal whether your site has been specifically configured for security or left at defaults.

Missing Content Security Policy headers, missing HSTS, missing X-Frame-Options, and server version disclosures all tell an attacker something about the likelihood of specific attack categories succeeding. A site missing most of its security headers is a site that probably hasn't received deliberate security attention.

GitHub and public repositories can expose credentials

Public GitHub repositories, and sometimes private ones connected to an account with insufficient access controls, can contain API keys, database credentials, private keys, and configuration files that were never meant to be public. Automated tools scan GitHub continuously for exactly these patterns.

A single exposed API key can provide access to cloud infrastructure, email services, payment processors, or internal systems, depending on what the key controls.

What this picture means in practice

An attacker running basic reconnaissance on a UK small business domain in ten minutes can determine whether email impersonation is viable, whether there are forgotten subdomains worth investigating, which services are running on which ports, whether the website has been hardened, and whether any credentials are exposed in public repositories.

That's enough information to decide whether to proceed and how. The businesses that don't get targeted aren't necessarily more secure — they're often just harder to exploit quickly, which moves the attacker to an easier target.

Olimpio runs the same reconnaissance and shows you the picture before an attacker does.

Frequently asked questions

Is it legal for an attacker to gather this information? The reconnaissance described here uses only publicly available information — DNS records, certificate transparency logs, HTTP headers. Gathering it isn't illegal. What's done with it may be.

Does using a CDN like Cloudflare hide this information? A CDN hides your origin server's IP address and can add security headers, but your DNS records, subdomains, and certificate history remain public. A CDN reduces some exposure without eliminating the reconnaissance picture entirely.

How do attackers find businesses to target? Mostly through automated scanning of IP ranges and domain lists, not manual selection. Your business appears on lists based on your IP range, your domain registrar, your hosting provider, and any public mentions that make your infrastructure discoverable.

Can we find out if our domain has already been investigated? Not directly — reconnaissance leaves no trace on your systems. What you can do is run the same reconnaissance on yourself and understand what an attacker would find.

How long does it take an attacker to gather this information? Minutes for basic reconnaissance. A more thorough pass might take an hour. Automated tools run continuously, meaning this information is being gathered about your domain regularly whether you're aware of it or not.

Run a free scan to see exactly what an attacker would find when they look at your business: olimpio.io/free-scan