The campaign ended in 2022 and the site is still online, running a content management system three major versions behind, on hosting your IT team has never seen. It carries your brand, it collects enquiries through a form, and it appears in exactly the same certificate transparency logs an attacker searches. Vulnerable and outdated components sit in the OWASP Top 10 for good reason, and these sites are where they live longest.
Why these sites drift out of view
They are commissioned by marketing, built by an agency and paid for on a card, which means they never appear on an IT asset list or in a procurement record anyone reviews. The agency holds the administrative account and sometimes the domain registration. When the relationship ends the site keeps running, because nobody wants to be responsible for taking down something that might still matter. A year later the plugin that powers the enquiry form has a published vulnerability and there is no process that would ever apply the update.
What an attacker gains from one
Access to a small site is worth having for three reasons. It hosts content under your brand, so a defacement or a fake login page is convincing to your customers. It sits in your domain namespace, which lends credibility to phishing and can allow cookie scoping problems if the main site shares the parent domain. It usually holds a database of enquiry submissions with names, email addresses and messages, which is personal data you did not know you were still processing. None of that requires the site to be connected to your internal network.
“The site everyone forgets is the one that hurts, and the reason is always the same: the person who commissioned it left the business. Ask marketing for every domain and microsite they have paid for in the past five years, then compare that list with your DNS records. The difference is your problem list, and it is never empty.”
William Fieldhouse, Director, Aardwolf Security Ltd
Finding them systematically
Work from data rather than memory. Pull every DNS record for your domains, query certificate transparency logs for certificates issued in the past three years, and ask finance for recurring payments to hosting and domain registrars. Cross-reference the results against the sites your team can name. Pay attention to records pointing at hosting that no longer answers, since a dangling record aimed at a decommissioned cloud service can often be claimed by somebody else and turned into a site on your subdomain. An external network testfinds these quickly because the tester is looking with the same tools an attacker would.
Deciding what happens to each one
Every site needs one of three outcomes: retire it, adopt it, or transfer it with a documented owner. Retiring is cheapest and usually correct, and it means removing the DNS record as well as the hosting so nothing can claim the name. Adopting means bringing it under your patching and backup regime and taking control of the administrative accounts. Where a site stays with an agency, put update responsibility and a breach notification obligation into the contract, and commission a web application security reviewfor anything that collects personal data or carries a login.
Frequently asked questions about forgotten sites
These questions come up whenever an attack surface review reaches marketing assets.
Does it matter if the site holds no data?
Yes. Brand impersonation and phishing credibility are the main risks, and a site with no data can still be modified to serve malicious content to visitors who trust your domain.
Who should own microsites long term?
Marketing owns the content and IT owns the platform, with a single named person accountable for each site. Sites with no name against them are the ones that end up in a report like this.
