Follow a scan and manage multiple domains

If a company has several domains, for example the parent company Meccanica Adda (meccanicaadda.it) and its subsidiary Adda Servizi (addaservizi.it), you can analyse them all in a single multi-domain scan. This guide shows how to create it and how to follow its progress through to the results.

Goal

Start a scan across several domains, see where it stands while it runs, and open each company's results only once the scan has finished.

Prerequisites

• At least two domains to analyse, with the country and ideally the VAT number or name of each company.
• Enough Cyber Tokens for every domain: each domain costs 90 tokens at the end-user price and 50 tokens at the partner price.
• You already know the single-domain flow (see the article on your first external scan).

Steps

1. Choose the multi-domain scan

   Click New Mapping and select the Multiple Domain Scan tab. The settings are the same as for a single scan: mapping is always on and you can leave Vulnerability Detection on.

2. Enter the domains

   For Domain 1 type meccanicaadda.it, choose VAT Number, enter the VAT number and select Italy. The first domain is the primary one: the scan is named after its company. For Domain 2 type addaservizi.it, the Company Name (Adda Servizi) and Italy again. The form starts with two domains; to add more click Add Another Domain. Then click Continue to Company Enrichment.

3. Find each company's data

   For each domain click Find Company Data and pick the right company from the results: address, industry, employees and revenue are filled in automatically. If it is not the right one, use Search Again.

4. Review and create

   Check the company data and click Review & Create Scan. The Scan Summary lists the companies, and the Cyber Token Transaction box shows the tokens needed for all domains. Click Create Multi-Domain Scan.

5. Follow the progress

   Open the scan from the dashboard. While it runs, the Mapping Progress card shows the percentage and the current phase. You do not need to keep the page open: the work continues on the server and you can reopen the scan whenever you like.

6. Open the results

   When the status turns Completed, the Overview shows the results. On the attack surface map use Select Asset to switch between domains: each company keeps its own assets and its own risk.

Scan phases

The text under the Mapping Progress bar names the current phase. The main phases, in order, are:

1. Initialization and start of the scan tools.
2. Subdomain discovery.
3. IP address resolution.
4. Network port scanning and service fingerprinting.
5. Web application analysis and screenshot capture.
6. TLS/SSL certificate scanning and sitemap crawling.
7. Technology analysis, TLS fingerprinting and operating system detection, with validation of the detections.
8. Vulnerability scanning and finalization.

Use the percentage to see how far the work has got, not as a precise estimate of the time left.

Result

The scan appears on the dashboard with the status Completed and the Overview shows the metrics and the map. With Select Asset you move between domains, each with its own results. Only interpret the data once the scan has finished.

Troubleshooting

• The status stays Queued or Pending: the scan is waiting for its turn; it starts on its own, you do not need to do anything.
• The status is Partial: the scan finished but a non-critical tool did not complete its work. The main results are still available.
• The status is Failed: see the article on failed scans.

Related articles