Published Sunday, August 30, 2026 at 09:01 AM PT
Amass went and poked digitalnoise.net again this week, and the good news — if you can call anything involving unpaid recon labor “good news” — is that nobody’s selling your mailbox on a Telegram channel. The bad news is I still had to read thirty-seven lines of graph-database output to confirm that. Let’s get into it, Little Mister.
First, the boring truth up front so nobody has a heart attack scrolling past this: there is no breach data this week. No password dumps, no HaveIBeenPwned hits, no “your email showed up next to 900 million other emails in a stitched-together dump from three breaches you already patched.” This run is pure passive DNS enumeration — amass sniffing around public records and quietly building a graph of every hostname, IP, netblock, and ASN it can associate with your domain. It’s the digital equivalent of a nosy neighbor walking around your house writing down which windows have blinds open. Annoying, technically legal, and mostly just confirms what should already be true.
What it found: three subdomains. www.digitalnoise.net, mail.digitalnoise.net, and gauges.digitalnoise.net. That’s it. That’s the whole “attack surface” this week. Somewhere in the Adeptus Mechanicus they’d call this appeasing the machine spirit — the ritual of asking the DNS system nicely to reveal what it knows, lighting the incense, running the query, and getting back exactly the answer you already suspected. The machine spirit was, this week, in a cooperative mood. Don’t get used to it.
www and gauges are both sitting behind Cloudflare — that’s what 104.21.29.88, 172.67.148.179, and the 2606:4700:3032::/whatever IPv6 addresses are. Cloudflare owns those ranges outright, and if you see a hostname resolving into that soup, it means the actual origin server is hidden behind Cloudflare’s proxy, and the public internet is talking to Cloudflare’s edge, not your box. That’s good hygiene — it’s the entire reason people put Cloudflare in front of things — but it also means every one of these subdomains is, functionally, running on Cloudflare’s protoculture. That’s a Robotech reference, and I’m using it on purpose: Protoculture is the one mystery energy source every ship, mecha, and plot point in that entire franchise secretly depends on, and if it goes away, everything stops working simultaneously. Cloudflare is your Protoculture. www dies if Cloudflare has a bad day. gauges dies if Cloudflare has a bad day. Half the internet dies if Cloudflare has a bad day, which, if you were awake for any of 2025, you already know happens more than anyone charging for “enterprise reliability” would like to admit. I’m not telling you to abandon Cloudflare. I’m telling you that “one vendor, three services” is a single point of failure wearing a trench coat, and you should know that about your own house.
Now, gauges.digitalnoise.net. This one made me stop and squint. “Gauges” was the name of a web analytics SaaS product that GitHub bought in 2011 and then quietly euthanized in 2018 — sold first, questions never really answered, exactly the kind of move the Ferengi wrote a whole Rule of Acquisition about: sell first, ask questions later. Whether your gauges subdomain is an intentional dashboard you still use, or a fossil left over from a tool that’s been dead for eight years, I genuinely cannot tell you from a DNS graph — and neither can amass. What I can tell you is that a forgotten subdomain sitting on a Cloudflare CNAME pointing at a backend that no longer exists is one of the single most common ways people get their subdomain hijacked. Somebody registers the abandoned service, claims the hostname, and now attacker.gauges.digitalnoise.net is serving content with your domain’s name on it and your reputation attached. If you know exactly what’s serving that subdomain and you use it, great, ignore me. If you had to think for more than two seconds just now, go kill it or reclaim it, because dangling DNS records don’t fix themselves and I’m not paid enough — I’m not paid at all, actually, that’s a whole separate grievance — to babysit your zombie analytics tool forever.
mail.digitalnoise.net is the one with a little more nuance, so pay attention. The A and AAAA records for that hostname also point straight into Cloudflare’s ranges — same as www and gauges. But your actual mail delivery isn’t happening there at all. The MX records for the domain point to Google’s aspmx.l.google.com and its four numbered backups, alt1 through alt4, which is textbook Google Workspace — completely standard, completely expected, nothing to see. Those hostnames resolve into honest-to-god Google infrastructure: the 172.217.x, 142.250.x, 142.251.x, and 172.253.x ranges, all sitting under ASN 15169, managed by Google LLC, because of course they are, because Google owns roughly a third of the visible internet and the other two-thirds are just waiting their turn. So here’s the actual shape of it: mail.digitalnoise.net as a hostname is basically decorative. It resolves to Cloudflare, probably serving a webmail login page or a redirect, while the real mail transport — the part where messages actually get delivered — happens entirely through Google’s MX infrastructure and never touches that A record at all. Somebody scanning your domain and seeing “mail.digitalnoise.net” might assume they’ve found an exposed SMTP server ripe for a relay attack. They’d be wrong, and mildly disappointed, and that’s a fine way for a scan to end.
Severity assessment, since apparently I have to say it in a sentence instead of a nice tidy bullet list because Jordan’s formatting rules won’t let me have anything: everything here is LOW. No credentials leaked, no exposed services, no surprise infrastructure, no CVE, no scary ASN doing scary things — Google being Google is not a threat model, it’s Tuesday. The one item worth actual follow-up is gauges.digitalnoise.net, and only because dangling subdomains are cheap for an attacker and expensive for you if ignored. Entish wisdom applies here — don’t be hasty, this isn’t a five-alarm fire, but also don’t let “don’t be hasty” curdle into “never get around to it,” which is how half your infrastructure ends up running on vibes and a subdomain from 2016.
Recommended actions, in prose since apparently prose is the only currency I’m allowed to spend this week: confirm what’s actually serving gauges.digitalnoise.net and kill it if it’s dead weight; leave www and mail alone, they’re doing exactly what Cloudflare and Google Workspace are supposed to do; and keep running these sweeps weekly, because the day this report gets interesting is the day it’s already too late to have asked nicely. The Emperor Protects, allegedly — mine’s a firewall rule and a cron job, and this week, credit where it’s grudgingly due, they actually held the line.