3 ms·
For sni to be effective, you need to be hitting hosts that serve more than one domain. Otherwise, you can just reverse map the ip.
by ec109685 8y ago
For sni to be effective, you need to be hitting hosts that serve more than one domain. Otherwise, you can just reverse map the ip.
- y4mi 8y agoMost of my severs don't report the actual service dns back on a reverse lookup. It's generally nodeXX.some.fqdn or clusterXX or lbXX
- jedberg 8y agoYes but if I want to specifically look for traffic to the Debian mirrors, I can use DNS to build a list of the IPs and then see if you're connecting to one of them.
- shittyadmin 8y agoDoesn't really matter either way - there's a bunch of crawlers and scanners out there such that you can pretty much Google any IP and find a list of sites that are hosted on it.
- dcbadacd 8y agoFun fact, most of those break if you just close the connection when the client doesn't support SNI.
- shittyadmin 8y agoNot quote the ones I was referring to - many services just look at DNS and get the A record for every domain then offer reverse lookup - complete lists of domains are purchasable for all major TLDs. The only defense to this would be to host your content on a subdomain. DNSlytics, DomainTools, W3Advisor and others offer this.
- Ayesh 8y agoIt's also easy to just scan a whole range (say, top 1m Alexa domains) and log the IP. You can scan 1m sites on a cheap $5 VPS nowadays.
- pbhjpbhj 8y agoMost services report what they are, and even the server often, when you connect. If you connect to an IP and it's serving a website then I don't know why you'd care that reverse-lookup isn't configured correctly, you're not hiding anything?
- admax88q 8y agoIts feasible to build a reverse lookup table of all registered domain names.