Systems and methods for external detection of misconfigured systems

A computer-implemented method for external detection of a vulnerable system, the vulnerable system coupled to a communication network, the method comprising:

• monitoring communication traffic in the communication network to identify one or more domain names, the communication traffic originating from one or more server systems in the communication network;
• executing queries on the communication traffic to extract metadata while monitoring the communication traffic;
• identifying the one or more domain names based on the metadata, each domain name having a property indicative of vulnerability, the metadata comprising a geographical location associated with each identified domain name;
• determining whether each domain name, of the one or more domain names, is registered at a domain name registry;
• and
• if the domain name is not registered, registering the domain name based on a high frequency of domain names having a property indicative of vulnerability in a particular geographical location.