Audit your own domain the way an attacker would read it.
As part of auditing my own domain’s security posture, I ran a passive Certificate Transparency query against yulan.me, pulling every certificate ever logged for the domain. It is a fully public and non-intrusive data source: nothing is touched, only read.
The overwhelming majority had nothing to do with my own infrastructure: certificates issued, in bursts over many months, for subdomains carrying clear spam and pirated-content naming patterns. It is the footprint of an ad-arbitrage or SEO-spam operation exploiting a previous registration of the domain.
Certificate Transparency logs are permanent and publicly auditable by design, so that record persists regardless of who owned the domain at the time. It cannot be deleted. It can only be understood.
Collection is trivial. The work was separating the one actionable line from the noise, and confirming the noise really was just noise.
I verified the finding with passive DNS lookups: none of the flagged subdomains currently resolve, and the zone carries no live wildcard record today. Cross-referencing issuance dates against my own ownership window showed a clean boundary. Nothing matching the historical spam pattern has been issued since I acquired the domain, only routine automatic renewals from my own hosting setup.
Five steps, one of which mattered.
- 01
Queried the public logs
Certificate Transparency records pulled for a domain I own, passively and non-intrusively.
- 02
600+ records surfaced
Historical certificates spanning several years.
- 03
A pattern predating ownership
Spam issuance peaking months before I acquired the domain.
- 04
Verified as inert
Passive DNS confirms no flagged subdomain resolves, and no live wildcard exists.
- 05
The one action
Ongoing CT-log monitoring, so any future unexpected issuance is caught rather than discovered.