pushidrosal.id

Posture summary

Public attack surface (22 hostnames in Certificate Transparency)

Hostnames this organization published in public TLS certificates. Passive OSINT — nothing was scanned; a wildcard certificate is in use, so the real footprint may be larger.

The hostname inventory — which forgotten hosts exist and where — is part of the complete audit for this domain.

Lookalike domains (1 registered of 108 checked)

Registered permutations of this domain. Existence is a fact, not an accusation — ownership and intent are not assessed. Those able to receive mail are the ones usable for invoice fraud and phishing.

Recommendations

• highEnforce DMARC

  No enforcing DMARC policy was observed. Publish a DMARC record and move to p=quarantine then p=reject to reduce spoofing.

• mediumEnable DNSSEC

  DNSSEC signing was not detected for this domain.

• criticalReset credentials seen in infostealer logs

  Public infostealer telemetry associates 69 employee credential set(s) with this domain — passwords captured from infected devices, which bypass password policy and often session-hijack past MFA. The most recent dates from 2026-04-25. Most commonly RedLine. Force a reset for the affected services, invalidate active sessions, and check the devices themselves.

• mediumStrengthen password requirements

  98% of the exposed employee passwords analysed rate as weak or very weak. Raise minimum length and screen new passwords against breach lists.

• mediumLookalike domains are registered

  1 permutation(s) of this domain resolve. None accept mail today, but that can change without notice.