Domain Hygiene Audit for yulan.me
A passive Certificate Transparency audit of my own domain, and what six hundred history rows actually meant.
As part of auditing my own domain's security posture, I ran a passive Certificate Transparency query against yulan.me — pulling every certificate ever logged for the domain, a fully public and non-intrusive data source.
The query returned over 600 historical certificate records. The overwhelming majority had nothing to do with my own infrastructure: certificates issued, in bursts over many months, for subdomains carrying clear spam/pirated-content naming patterns — the kind of footprint left by an ad-arbitrage or SEO-spam operation exploiting a previous registration of the domain. Certificate Transparency logs are permanent and publicly auditable by design, so that record persists regardless of who owned the domain at the time.
I verified the finding with passive DNS lookups: none of the flagged subdomains currently resolve, and the zone carries no live wildcard record today. Cross-referencing issuance dates against my own ownership window showed a clean boundary — nothing matching the historical spam pattern has been issued since I acquired the domain, only routine automatic renewals from my own hosting setup.
The real work here wasn't finding six hundred records — collection is trivial. It was separating the one actionable line ("set up ongoing monitoring so this can't happen again unnoticed") from the noise, and confirming the noise really was just noise before treating it as such.
What it involved
- Queried public Certificate Transparency logs against a domain I own
- Surfaced 600+ historical certificate records spanning several years
- Identified a spam-issuance pattern predating my ownership, peaking months before acquisition
- Verified via passive DNS that no flagged subdomain currently resolves, and no live wildcard exists
- Setting up ongoing CT-log monitoring to catch any future unexpected certificate issuance