New Subdomain Launch in Certificate Transparency Logs
Every publicly trusted TLS certificate is written to certificate transparency logs, which means a company's new subdomains become visible the moment they are provisioned — often weeks or months before anything is announced. Avina detects newly observed customer-facing subdomains on target company domains within the last three months, so your team can engage while a new product, portal, region, or program is still being built rather than after it launches.
Why a New Subdomain Is a Buying Signal for Sales Teams
Subdomains leak strategy. A company that provisions status.company.com is standing up incident communication. One that provisions docs. or developers. is building a public API surface. trust. or security. means an enterprise security review forced a trust center. app.eu. or eu. means data residency work. careers. or jobs. moving off a hosted ATS domain means recruiting is being brought in-house. store., billing., partners., academy., community. — each of these maps to a specific program with a specific budget and a specific owner. What makes this signal valuable is timing. Certificates are typically issued during staging and pre-production, so the subdomain exists while the project is mid-build. That is the window in which vendor decisions are still open. By the time the launch blog post appears, the tooling has usually been chosen. A rep who reaches out about API documentation infrastructure the week a docs subdomain appears is early; the one who reaches out after the developer portal launches is late. The pattern across a company's subdomains also describes its stack and its direction. Newly appearing vendor-hosted subdomains — a CNAME pointed at a help center, a marketing automation tool, a status page provider, a customer community platform — are effectively technographic evidence of a purchase that just happened, which is as useful for displacement plays as it is for complementary ones. A sudden cluster of new subdomains in a short window usually means a platform or rebrand project is underway. The caveat is real and worth stating: certificate transparency captures a lot of noise. Ephemeral preview environments, per-customer tenant subdomains, CDN infrastructure, and wildcard certificates all produce entries that mean nothing on their own, so the value comes entirely from filtering to durable, customer-facing hostnames.
How Does Avina Detect New Subdomains?
Avina monitors public certificate transparency logs for certificates issued against target company domains, and cross-checks public DNS to confirm which newly observed hostnames actually resolve. Hostnames are then filtered to those that are durable and customer-facing: entries matching preview, staging, ephemeral, per-tenant, and CDN infrastructure patterns are discarded, and wildcard-only issuance is ignored because it reveals nothing specific. Surviving hostnames are classified by what they indicate — documentation and developer portals, status and incident pages, trust and security centers, regional or data-residency deployments, commerce and billing surfaces, community and academy properties, partner portals, and vendor-hosted subdomains whose CNAME target identifies the vendor behind them. Avina reads response headers and page content on the resolved host to confirm the classification, and cross-references correlated signals such as related job listings, product announcements, and technographic changes so a new subdomain is interpreted as part of a project rather than in isolation.
What Happens When a New Subdomain Signal Fires?
Avina scores the account based on what the subdomain indicates, whether it resolves to a vendor-hosted service or self-hosted infrastructure, how many related hostnames appeared in the same window, and correlated hiring or product activity at the company. Relevant contacts — depending on the subdomain type, that may be VP of Engineering, Head of Developer Experience, CISO, VP of Product, or Head of Customer Experience — are enriched with verified emails, phone numbers, and LinkedIn profiles through waterfall enrichment. Reps receive a Slack alert with the company name, the hostname detected, the date it was first observed, the classification Avina assigned, and any vendor identified behind it. CRM records in Salesforce or HubSpot are updated with the full signal context. Qualified accounts can be auto-enrolled into Outreach or Salesloft sequences matched to what the subdomain reveals — developer documentation and API tooling for a new docs portal, incident and status tooling for a new status page, compliance and trust center tooling for a new security portal, and data residency or regional infrastructure tooling when a geographic deployment appears.
Start Tracking New Subdomains With Avina
Subdomains appear while a project is still being built, which is the only time vendor decisions are still open. Activate this signal in Avina's Signals Library and get notified when a target company provisions a new customer-facing hostname. Every plan includes a 7-day free trial with no credit card required.