Glossary
These entries explain the external attack surface. They follow a name as it becomes a site, the records that protect the connection and the mail, and what an outsider can already look up. Where ZeroKai reads a public record, the entry says so. The rest is background.
Questions about using ZeroKai? See the FAQs.
When a person types a company name into a browser, a name is looked up, an address is found, and a page is requested.
ウェブサイト
The pages a person opens in a browser, and the service that answers behind them. Alongside the page itself, the name, the IP address, the certificate, and the mail settings each exist as their own public piece.
What ZeroKai looks atZeroKai reads those public pieces. An assessment does not open the page.
ブラウザ
The program a person uses to open a website. It asks for the name to be resolved, checks the certificate when the page is HTTPS, and displays the result. A warning in the address bar means the browser was not satisfied that the name and the certificate belong together.
ウェブサーバー
The software that answers a browser's request with a page or data, or the computer that software runs on. That role is separate from the registrar, which looks after the company's name.
What ZeroKai looks atAn assessment sends no request to the web server. It reads the published name and records.
ドメイン名
A human-readable name on the internet, such as example.co.jp. A company registers it with a registrar for a period of time. When the registration lapses, someone else can register that same name. The name points at the site. It is not the site's contents.
What ZeroKai looks atAn assessment gathers public records for the domain name you enter.
サブドメイン
A name added to the left of a domain. mail.example.co.jp and vpn.example.co.jp can each point somewhere different from example.co.jp. The company's public entrances are often more than the main page.
ホスト名
A single name DNS can look up. example.co.jp and www.example.co.jp are different hostnames, and they can have different addresses and different certificates.
What ZeroKai looks atZeroKai collects published hostnames from Certificate Transparency logs and DNS.
Domain Name System
The internet's directory. It turns a name into an IP address, and it also stores where mail should go and which certificate authorities may issue certificates. A resolver answers those questions on behalf of the requester. A browser normally asks a resolver for the name.
What ZeroKai looks atZeroKai sends its DNS questions to public resolvers over DNS over HTTPS. It does not ask the server being assessed.
DoH
A way to send a DNS question inside an encrypted web connection. Older DNS questions could be read by the network in between. This protects the lookup. It is a different layer from HTTPS on the website itself.
What ZeroKai looks atZeroKai uses this method for questions to public resolvers.
ネームサーバー
A server that answers DNS questions for a domain. The registrar publishes which nameservers receive those questions. That is a different machine from the web server that delivers the site.
What ZeroKai looks atZeroKai reads the published nameservers from registration data and DNS.
DNSレコード
One line in that directory. A and AAAA hold IP addresses, CNAME holds another name, MX holds the mail servers, TXT holds a note, NS holds the nameservers, and CAA names the certificate authorities that may issue certificates. The same record type can mean different things depending on the text inside it.
What ZeroKai looks atAn assessment reads these records as they are published.
Canonical name
A DNS record that says: when someone asks for this name, look at that other name instead. Companies use it to point www at a hosting provider, or to keep an old name attached to a new one. A destination that no longer exists is a separate problem.
IPアドレス
The numeric address of a computer on the internet. An IPv4 address looks like 203.0.113.10. An IPv6 address is longer. One name can have several addresses, and many names can share one address.
Uniform Resource Locator
The address of one page or piece of data. In https://example.co.jp/pricing, https is the kind of connection, example.co.jp is the hostname, and /pricing is the place inside that site. A domain name is one part of a URL.
Hypertext Transfer Protocol
The procedure a browser and a web server use to request and return pages and data. It says which page is wanted and how the answer is sent. On its own, HTTP leaves the conversation readable along the way. The encrypted form is HTTPS.
Application Programming Interface
A door for programs to talk to each other, rather than a page meant for a person. It usually runs over HTTPS. A hostname such as api.example.com can point at this kind of door.
What ZeroKai looks atAn assessment does not call the API. It stops at the name appearing in public records.
How the conversation between a browser and a server is encrypted, and how the browser decides who is answering.
HTTP Secure
HTTP wrapped in TLS. The conversation is encrypted, and the browser uses a certificate to check the name on the other side. A lock icon means the browser accepted that check. It does not vouch for how passwords are handled, or for flaws in the software on the server.
Transport Layer Security. The older name is SSL
The procedure that encrypts a connection and uses a certificate to check the other party. The older name SSL is still heard. Current websites use TLS. HTTPS on a site sits on top of this procedure.
暗号化
Turning a message into a form that only the intended party can read. On a website, TLS encrypts the conversation between the browser and the server. An encrypted conversation is a separate question from data stored on the server, or from a weak password.
Also called a TLS certificate or an SSL certificate
A public document that ties a name to a public key, names the authority that checked it, and states when it expires. The browser looks for the name it is opening inside that document. An expired certificate, or a certificate for a different name, produces a warning.
What ZeroKai looks atZeroKai reads issuance and expiry from Certificate Transparency logs. A log entry does not mean that certificate is installed on the server now. A near expiry is reported as reference information.
秘密鍵
The secret half that matches a certificate. The certificate itself is public. Whoever holds the private key can answer as the names on that certificate.
What ZeroKai looks atZeroKai never receives a private key.
Certificate authority, CA. 認証局
An issuer of certificates that browsers trust. Let's Encrypt is a widely used one. Companies and governments run authorities too. A trusted authority can issue a certificate for a name once its checks pass. A CAA record narrows which authorities are allowed to do that.
Certificate Transparency, CT logs. 証明書の透明性
A system that records newly issued certificates in logs anyone can read. From outside, a company can see whether a certificate was issued for its name. The log records that a certificate was issued.
What ZeroKai looks atZeroKai reads hostnames, wildcards, and expiry from these logs. It does not fetch the certificate from the server. A log entry does not mean the certificate is installed there.
ワイルドカード証明書
A certificate such as *.example.com that can cover many subdomains at once. If the private key leaks, every name under that pattern is affected together. The convenience and the breadth of impact sit on the same certificate.
What ZeroKai looks atWhen a wildcard appears in a CT log, ZeroKai shows it as reference information. Presence in the log does not mean it is installed.
Certification Authority Authorization
Certification Authority Authorization. A DNS record that names which certificate authorities may issue certificates for the domain. Authorities that are not on the list are expected to refuse.
What ZeroKai looks atWhen no CAA record is published, ZeroKai reports it as reference information. A missing record is not treated as an immediate danger on its own. Publishing one narrows issuance to the authorities you name.
Domain Name System Security Extensions
A way to sign DNS answers so tampering can be detected. A resolver that supports it can treat a missing or mismatched signature as suspicious. It is still uncommon in Japan.
What ZeroKai looks atWhen no DS record is published and registration data does not show DNSSEC, ZeroKai reports it as reference information. Leaving it off is not treated as an immediate danger on its own.
The website and company mail share a domain name. Weak mail settings make it harder for receivers to recognize fake mail that wears the company's name, even when the website itself is fine.
メール
Messages with a sender and a recipient, carried between mail servers. The address a person sees and the server that actually sent the message can be checked separately. SPF, DKIM, and DMARC are the published rules for that check.
Mail exchange
A DNS record that names the servers which accept mail for the domain. It is set separately from the website's address. Judging the contents after delivery is the job of SPF and DMARC.
なりすまし
Someone else presenting a message or a site as the company or as a member of staff. For mail, receivers use SPF, DKIM, and DMARC to judge whether the visible sender and the actual source agree.
フィッシング
A message or page that pretends to be a trusted party so that someone will hand over a password, a payment, or a file. A lookalike domain and a weak mail setting on the real domain are different problems.
What ZeroKai looks atZeroKai does not read the company's mailbox and does not open links in mail. It reads the published SPF and DMARC records.
Sender Policy Framework
Sender Policy Framework. A TXT record beginning with v=spf1 that publishes which servers may send mail for the domain. Receivers check whether the actual sender is on that list. The domain publishes one record. More than one is an error under the specification, and the check stops working. A record ending in +all means every server is allowed, so the list does not limit senders. More than 10 DNS lookups can make evaluation fail, including for legitimate mail. A domain that sends no mail can publish v=spf1 -all.
What ZeroKai looks atZeroKai reads the published SPF record over DNS over HTTPS.
DomainKeys Identified Mail
DomainKeys Identified Mail. The sending server signs the message and publishes a public key in DNS. A receiver can check that the message still matches, and that a server the domain authorized signed it. DMARC uses the SPF and DKIM results. Checking a signature requires a real message.
What ZeroKai looks atThe assessment reports the published SPF and DMARC records. It does not read messages, and it does not check DKIM signatures.
Domain-based Message Authentication, Reporting, and Conformance
A TXT record at _dmarc.example.com, beginning with v=DMARC1. Mail passes when the visible sender aligns with SPF or with DKIM. The record tells receivers what to do when it aligns with neither. p=none means deliver it and send reports. p=quarantine means treat it as suspicious. p=reject means refuse it. Reports go to the address in rua=. A common path is to start at p=none, watch legitimate mail authenticate, and tighten from there.
What ZeroKai looks atZeroKai reads the published DMARC record from DNS. It does not receive the company's DMARC reports.
A registry keeps the official list of names, and a registrar takes the registration. The company that hosts the site and the company that renews the name are often different.
Top-level domain, TLD. トップレベルドメイン
The ending of a name, such as .jp or .com. In Japan, company names are often registered one level down, as .co.jp. The registry for that ending sets the rules and holds the registration data.
レジストラ
The company that takes the registration and the renewal of a domain name. This is often who gets paid for the name. Hosting and email are frequently separate contracts.
レジストリ
The organization that keeps the official list for a top-level domain. It records which name is registered to whom, based on requests from registrars. The registry for .jp is JPRS.
Japan Registry Services. 日本レジストリサービス
Japan Registry Services. The registry for .jp domain names. When a Japanese company registers under .jp or .co.jp, this is the organization behind that list.
What ZeroKai looks atWhen registration data for a domain comes from JPRS, ZeroKai reads that public information.
WHOIS
A long-standing way to query domain registration data. It can return the registrar, dates, expiry, nameservers, and sometimes a contact. Contacts are often hidden now. RDAP is the newer, structured way to read the same kind of facts.
What ZeroKai looks atAn assessment reads registration and expiry from public WHOIS and RDAP data.
Registration Data Access Protocol
Registration Data Access Protocol. A structured way to return the same kind of facts WHOIS shows, so a program can read them. That includes the registrar, status, expiry, and nameservers.
What ZeroKai looks atZeroKai reads registration and expiry from RDAP and WHOIS.
ドメインの有効期限
The date the registration period ends. After that date, and after any grace period the registry allows, someone else can register the name. Both the website and mail can then follow wherever the new holder points them.
What ZeroKai looks atZeroKai reads this date from RDAP and WHOIS registration data.
TXTレコード
A DNS record that stores a piece of text. SPF, ownership checks, and other notes share this one type. The meaning comes from the text, not from the record type alone.
What ZeroKai looks atZeroKai reads TXT records for SPF and for ownership verification. DMARC is a TXT record under the name _dmarc.
After a name resolves, some computer on someone's network answers. Public information about that address is a clue to who operates it.
ホスティング
The service that provides the computers a website or other service runs on, or those computers themselves. The registrar, the mail provider, and the host are commonly three different companies.
What ZeroKai looks atFor an IP address, ZeroKai reads public network information as a clue to the host. It does not see the contract.
Content delivery network. コンテンツ配信ネットワーク
Content delivery network. A large set of servers that answer for a site from a place near the visitor. DNS can point at the CDN's name, and the company's own server can sit behind it.
Autonomous system number. 自律システム番号
Autonomous system number. The number of a network that announces its own ranges of IP addresses on the internet. Cloud providers, access providers, and large companies have one. It is a clue to who operates an address. It is not proof of a contract with that company.
RIPEstat
A public information service from the RIPE NCC about IP addresses, routing, and which network announces an address. It is run by the European registry and returns public data about addresses worldwide.
What ZeroKai looks atZeroKai uses RIPEstat for network information about IP addresses. It does not connect to the server being assessed.
Before trying anything, an outsider reads what is already public. These words are that list, and how to read it.
サイバーセキュリティ
The work of keeping a company's systems, names, and information from being misused or knocked offline. For a public website, a practical start is to write down what an outsider can already see.
攻撃対象領域
The names, addresses, services, and settings an outsider can already find and might try to use. Besides the main page, it includes other hostnames, mail rules, certificates, and services that already appear in a public index. Mapping it means holding that list first.
What ZeroKai looks atZeroKai builds this list from public records.
露出管理
A list of exposed assets for a security team: domains, hostnames, addresses, and services observed in public data.
What ZeroKai looks atZeroKai builds this list when you run an assessment. The full list is shown after ownership is verified.
リスクインテリジェンス
A reading of which weaknesses to handle first, based on public records. The order is a priority for the security team. It is not a measurement of damage inside the system.
What ZeroKai looks atFindings are ranked from the public record, with the evidence and the time they were seen. Catalogs from CISA KEV, JVN, and NVD can be read separately. An assessment does not match those CVEs to the company's assets.
資産
Something in that list that belongs to the organization: a domain, a hostname, an address, or a service observed in public data. The product uses the word asset in this sense.
What ZeroKai looks atThe asset list is shown after ownership is verified. Before that, the view is a summary.
ポート
A number that distinguishes one service from another on a computer. Websites usually use 443 for HTTPS and 80 for HTTP. Remote access, file sharing, and databases use other numbers. Whether a number is open is known by asking that computer.
サービス
A program waiting on a port: a website, mail, remote access, or a database. A public service means one that can be reached from the internet, or one that a public index has already recorded.
ポートスキャン
Connecting to many ports to see which programs answer. It sends real traffic to the computer being examined.
What ZeroKai looks atZeroKai does not scan ports, and it does not connect to the server being assessed. Services are shown only after ownership verification, and only when someone else has already recorded them in a public index.
公開情報
Information anyone can obtain by asking shared infrastructure: DNS, certificate logs, registration data, routing data, and indexes such as Shodan. This way of collecting is sometimes called passive. The word means the server being assessed is left untouched. The check itself is a deliberate look at what is already public.
What ZeroKai looks atPublic records are what ZeroKai reads. DNS questions go to public resolvers, and the assessed server receives no connection.
Data from Shodan (shodan.io)
An outside index that records services visible from the internet and makes them searchable. An observation is from the past, so it can differ from the present. Where it is shown, the credit is “Data from Shodan (shodan.io)”.
What ZeroKai looks atOnly for a verified domain, ZeroKai can show services Shodan has already recorded, such as remote access, file sharing, databases, and FTP. ZeroKai does not run those scans itself.
Dangling CNAME. ぶら下がったCNAME
A hostname whose CNAME points at a name DNS says does not exist. If a third party can claim that destination at the cloud provider, they may be able to publish a site under the company's hostname. That risk is called a subdomain takeover. Whether the destination can actually be claimed depends on the cloud service. The conclusion is an inference from DNS alone.
What ZeroKai looks atZeroKai raises this finding when DNS over HTTPS shows a CNAME whose destination does not exist. It does not assert that a takeover is possible right now.
管理用に見える名前
A hostname whose label suggests an admin panel, remote access, or a test environment, such as vpn, admin, or staging. The clue is the name alone. What actually runs there is not settled by the name.
What ZeroKai looks atZeroKai reports names that resolve, as reference information. It does not open the site, and it does not confirm the purpose.
脆弱性
A weakness in software or configuration that lets someone do something the maker did not intend. A public report means the weakness is known somewhere in the world. It is not proof that a particular company's server is affected today.
What ZeroKai looks atThe product includes a view of public records from CISA KEV, JVN, and NVD. An assessment does not match those CVEs to the company's assets, and it does not use a vulnerability to probe anything.
Common Vulnerabilities and Exposures
A public identifier for a known vulnerability, written like CVE-2024-12345, so that advisories can point at the same issue. The number alone does not mean a fix exists, and it does not mean a particular server is still missing that fix.
Known Exploited Vulnerabilities
A catalog from the U.S. Cybersecurity and Infrastructure Security Agency of vulnerabilities with evidence of real-world use. The credit is CISA Known Exploited Vulnerabilities Catalog. An entry does not mean that company's server is affected.
What ZeroKai looks atThe product ingests this catalog daily and can show it as vulnerability intelligence. It does not match entries to assets.
Japan Vulnerability Notes, JVN iPedia. JVN
Japan Vulnerability Notes. Japan's public vulnerability information, involving IPA and JPCERT/CC. The product reads JVN iPedia through the MyJVN API. The credit is JVN iPedia via MyJVN API (IPA).
What ZeroKai looks atZeroKai ingests it for vulnerability intelligence. It does not decide that software on an assessed domain is affected.
National Vulnerability Database. 米国国立脆弱性データベース
The National Vulnerability Database, run by NIST in the United States. It records CVE entries and severity information. This product uses the NVD API but is not endorsed or certified by the NVD.
What ZeroKai looks atZeroKai reads NVD's public data on demand when looking up a CVE. It does not match those records to assets.
The words on an assessment. A rank that looks severe is an order derived from public records. It is not the result of breaking into the system.
評価
One pass over a domain: collect public records, apply the checks, and list what was found and what stayed not covered.
指摘事項
One result of a check. A missing SPF record, a missing DMARC record, a CNAME with no destination, or an administrative-looking name is each its own finding. It comes with what was observed, the source, and what to look at next. Some findings, such as CAA and DNSSEC, are reference information. Reference information is not an alarm to fix this minute.
根拠
The record behind a finding: the DNS text, the certificate-log entry, or the registration field, with the source and the time it was observed. The explanation on screen and the record that was seen can be read separately.
重要度
A rank used to order findings: info, low, medium, high, and critical. It is assigned from the public record. It is not a measurement of damage confirmed by entering the system. Reference findings can still be worth reading.
Not covered. 確認済み / 一部のみ / 未確認
The label for how much of a check completed. Covered means the record could be read. Partial means only part of it. Not covered means a source did not answer, or this product does not perform that check. Not covered is never used to mean that nothing is wrong.
所有の確認
The step that shows the account controls the domain. Either the account email is on that domain, or the account publishes a DNS TXT record ZeroKai provides. After that, the asset list and finding details are shown.
What ZeroKai looks atShodan service observations are included only for a verified domain. Verification is not permission to scan the server. After verification, the assessment still does not connect to the target.
Protections a company usually runs beside the public records. They are not ZeroKai checks. They are here so the words have a place.
ファイアウォール
A set of rules that allow or block connections. It can sit on a server, at the edge of a company network, or in a cloud setting. It is one of the basic ways to reduce which services are reachable from outside.
What ZeroKai looks atZeroKai does not test firewall rules, and it does not send connections to see what is blocked.
マルウェア
A general name for software that acts against the owner's interest: taking data, sending unwanted mail, or giving someone else control.
What ZeroKai looks atAn assessment does not look for malware.
ランサムウェア
Malware that locks files or systems and demands payment to return them. Remote access and file sharing left directly on the internet are repeatedly reported as a way in.
アカウント
An identity used to sign in. The usual protection is a password that is not reused, and a second check beyond the password. A hostname that looks like an admin panel is not itself an account.
What ZeroKai looks atZeroKai does not see passwords and does not try to sign in.
Multi-factor authentication, MFA. 多要素認証
A requirement for a second proof besides the password, such as a code from an app, a hardware key, or an approval prompt. It is there so that a leaked password is not enough to sign in.
What ZeroKai looks atAn assessment does not check whether a site has multi-factor authentication turned on.
パッチ
An update the maker of a system publishes to fix a flaw. Many vulnerabilities that have a CVE already have a patch. Knowing the number and confirming that a server has the update installed are separate jobs.
What ZeroKai looks atZeroKai does not sign in to a server to see which updates are installed.
バックアップ
A copy kept so the organization can restore data after a failure, a mistake, or ransomware. A copy that stays on the same computer, reachable with the same passwords, can be lost with the original. A copy that can be restored is kept apart from the original.
What ZeroKai looks atAn assessment does not inspect backups.
Cookie
A small piece of data a site asks the browser to store and send back later. It is used to keep a sign-in and to remember display choices.
What ZeroKai looks atCookies on ZeroKai's own site are described in the privacy policy. An assessment does not read the cookies of the site being assessed.
These definitions describe public mechanisms and the records ZeroKai reads. They are not a procedure for probing someone else's system, and they are not advice about a live incident.