3 ms·
It's rather hilarious that nobody mentioned this in 7 hours. What am I missing? ~5 billion scans in a few hours is nothing for a company with decent resources.
by peeters 2y ago
It's rather hilarious that nobody mentioned this in 7 hours. What am I missing?
~5 billion scans in a few hours is nothing for a company with decent resources. OP: in case you didn't follow, they're literally trying every possible IPv4 address and seeing if something exists on standard ports at that address.
I believe it would be harder to find out your domain that way if you were using SNI and only forwarded/served requests that used the correct host. But if you aren't using SNI, your server is probably just responding to any TLS connect request with your subdomain's cert, which will reveal your hostname.
- Dylan16807 2y ago> What am I missing? That it was in fact mentioned many hours earlier, in more than one top level comment.
- peeters 2y agoI was referring more to the fact that the user agent explicitly contained the answer, rather than suggestions that it was IP scanning. But you're right I do see one comment that mentions that. And many more likely assumed the OP already figured that part out.
- Dylan16807 2y agoThe user agent contains a partial answer. IP scanning doesn't give you the actual subdomain, so the question is slightly wrong or there are missing pieces.
- diggan 2y agoJudging by the logs (user agents really) right now in the submission, it's hard to tell if the requests were actually for the domain (since the request headers aren't included) or just for the IP.
- Dylan16807 2y agoYes, that's the question being wrong option I listed.
- globular-toast 2y ago> What am I missing? It's very common for people to read only up to the point they feel they can comment, then skip immediately to the comment. So, basically, noone read it.
- flemhans 2y agoFunny, that'd be so unthinkable for me to do! But you're probably right.
- fragmede 2y agoJust the default hostname. It won't reveal all of them or any of the IP addresses of that box. secret-freedom-fighter.ice-cream-shop.example.com could have the same IP as example.com and you'd only know example.com
- A1kmm 2y agoIf you've got one cert with a subject alt name for each host, they'd see them all. If you use SNI and they have different certificates, the domains might still be in Certificate Transparency logs. If a wildcard cert is used, that could help to conceal the exact subdomain.