​
Subdomain Enumeration

Asset discovery begins by enumerating the target’s subdomains. Golem uses passive OSINT only — no DNS brute-force, no traffic to the target during enumeration. This keeps the engagement quiet and minimizes false positives.

​
The nine sources

Golem queries all of these in parallel and merges results: Each source contributes a partial view; combining them produces the most complete passive subdomain set practically obtainable. Each result records which source(s) surfaced it.

​
Validation

Raw OSINT results contain noise — expired DNS, typos, decommissioned hosts. Every candidate is validated:
  1. DNS resolution — does the subdomain still resolve?
  2. Liveness — is anything answering on HTTP(S)?
  3. Meaningful response — not a default parking page or uniform 404?
  4. Tech-stack fingerprinting — what is it running (feeds later phases)?
Validated subdomains become the working target set, with screenshots and stack data attached as assets.

​
Continuous monitoring

Subdomain scans can run standalone, and scheduled audits re-run them automatically. When a scan detects new or removed subdomains versus the previous scan, Golem notifies you — by email and Slack if connected — so newly exposed surface gets attention immediately.

​
Targets that don’t show up

Passive OSINT will miss:
  • Internal-only subdomains that never appear in CT logs or public scans
  • Subdomains created very recently (under a few hours old)
  • Subdomains intentionally excluded from public DNS

​
Programmatic access

Run subdomain enumeration as a standalone operation:
The scan runs asynchronously; poll the returned run ID for results. See the Subdomains API.