what attackers read about you before they ever attack

before anyone sends a single phishing email or scans a single port, they spend way more time reading than doing. this is the boring part of hacking nobody shows in movies, and it's also the part that never trips a single alarm because it's all public information. no exploits, no logins, just someone quietly building a profile of you or your company using stuff you put out there yourself. the good news is this same recon process works in reverse. if you know what they're reading, you know exactly what to fix.

subdomains expose forgotten servers

every company has subdomains nobody remembers creating. old-marketing-site.company.com, dev.company.com, that one staging server someone spun up for a demo in 2021 and never tore down. attackers pull these from certificate transparency logs, dns records, and passive recon tools, and they're looking for exactly one thing: the forgotten stuff still running an outdated login page or an admin panel with default creds.

the fix is to actually know your own attack surface. run a subdomain enumeration tool against your own domain occasionally and see what pops up. tools like subfinder or free lookups on crt.sh will show you everything a stranger could see. anything you don't recognize or don't need anymore, kill it or lock it down with proper access controls.

breach databases reveal reused passwords

your email address has probably been in a breach dump somewhere, maybe several. attackers don't need to guess passwords when old breaches already handed them a starting point, especially if you or your employees reused a password across accounts. this is credential stuffing 101 and it works terrifyingly often.

check your own exposure at haveibeenpwned.com for personal accounts and push your team to do the same. the actual fix isn't a clever trick, it's just discipline: unique passwords everywhere, a password manager so "unique" doesn't mean "impossible to remember," and multi factor authentication turned on for anything that matters. mfa alone shuts down the vast majority of these attacks even if the password is already floating around online.

employee names build a phishing list

linkedin, company "about us" pages, conference speaker lists, github commit history. all of it quietly builds a roster of real names, real job titles, and real email address formats. from there it's trivial to guess the pattern (first.last@company.com) and craft a phishing email that looks like it's coming from someone's actual manager.

you can't erase your team from the internet and you shouldn't try, but you can reduce how useful that data is. train people to expect spoofed internal emails, especially ones creating urgency around invoices, password resets, or "quick favor" requests. enable dmarc, dkim, and spf on your domain so it's harder to spoof your company's email convincingly in the first place. this is a five minute dns change that closes a door a lot of companies leave wide open.

document metadata leaks usernames and software

every pdf, word doc, and image you post publicly carries invisible baggage. author names, internal usernames, software versions, sometimes even file paths that reveal your internal folder structure. someone doesn't need to hack you to learn that your team is running an outdated version of a vulnerable app, the pdf you uploaded to your own website told them.

before you post anything public, strip the metadata. tools like exiftool let you check and clean this in seconds:

exiftool -all= yourfile.pdf

that command wipes the metadata clean. run exiftool yourfile.pdf first without the flag if you just want to see what's currently leaking before you decide what to strip.

the takeaway

none of this required a single exploit. subdomains, breach data, employee names, and metadata are all sitting in public view, and reading them isn't illegal or even technically impressive, it's just patient. the defensive move isn't paranoia, it's audit. check your own subdomains, check your own breach exposure, check what your public documents are actually saying about you, and lock down email spoofing before someone else uses your own name against you. less is more on the public internet, and most of the time, the fix is just cleaning up what you already forgot was out there.