5 ms·

Finding IP does not mean finding the domain. When doing HTTP request to IP you specify the domain you want to connect to. For example you can configure your /et

Finding IP does not mean finding the domain. When doing HTTP request to IP you specify the domain you want to connect to. For example you can configure your /etc/hosts to have xxxnakedhamsters.google.com pointing to 8.8.8.8 and make the http request, which will cause Google getting the domain request (i.e. header Host: xxxnakedhamsters.google.com) and it will refuse it or try to redirect to http. Of course it's only related to HTTP because HTTPS will require certificate. That's why they're speaking about certificates.

ghusto 2y ago
First thing I’d do for an IP that answers is a reverse lookup, so I expect that’s at least in the list of things they’d try.
lewiscollard 2y ago
Depending on the web server's configuration, you very much _can_ find the domain which is configured on an IP address, by attempting to connect to that IP address via HTTPS and seeing what certificate gets served. Here's an example: https://138.68.161.203/ https://138.68.161.203/ > Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 138.68.161.203. The certificate is only valid for the following names: exhaust.lewiscollard.com, www.exhaust.lewiscollard.com
- jchw 2y ago
  I don't think that does you any good for Cloudflare, though. They will definitely be using SNI.
  - kelnos 2y ago
    That doesn't really matter, though. While OP is using Cloudflare, the actual server behind it is still a publicly-accessible IP address that an IPv4 space scanner can easily stumble upon.
    - jchw 2y ago
      I misunderstood, I thought the subdomain was an R2 bucket. If it's just normal Cloudflare proxying to some backend this is probably the most likely answer. That said, while I think it's not the case here, using Cloudflare doesn't mean the underlying host is accessible, as even on the free tier you can use Cloudflare Tunnels, which I often do.
      - ratg13 2y ago
        they only state they are using cloudflare for DNS, they didn't say if they were proxying the connection
        jchw 2y ago
        Also a valid point. I guess without more details all we can really do is speculate about the exact setup. That said, I do now agree that the most likely answer is "the underlying host was accessible and caught by an IPv4 scanner" since well, that's pretty much what it says anyway.
  - deleted 2y ago
    [deleted]
melevittfl 2y ago
But there's no evidence in the OP's post that they have, in fact, discovered the domain. The only thing posted is that there is a GET request to a listening web server. The OP and all the people talking about certificates are making the same assumption. Namely that the scanning company discovered the DNS name for the server and tried to connect. When, if fact, they simply iterate through IP address blocks and make get requests to any listening web servers they find.
- p0w3n3d 2y ago
  OP states that the domain was discovered
  - crazygringo 2y ago
    No they didn't. They said "How did the internet find my subdomain?" They're assuming the internet found their subdomain. They don't provide any evidence that happened, just that they found their IP address.
- deleted 2y ago
  [deleted]
- denysvitali 2y ago
  I really doubt CloudFlare gives them an IPv4 and they can see all the logs for said IPv4
paxys 2y ago
> When doing HTTP request to IP you specify the domain you want to connect to No, you make HTTP requests to an IP, not a domain. You convert the domain name to an IP in an earlier step (via a DNS query). You can connect to servers using their raw IPs and open ports all day if you like, which is what's happening here. Yes servers will (likely) reject the requests by looking at the host header, but they will still receive the request.

ghusto 2y ago

First thing I’d do for an IP that answers is a reverse lookup, so I expect that’s at least in the list of things they’d try.

lewiscollard 2y ago

Depending on the web server's configuration, you very much _can_ find the domain which is configured on an IP address, by attempting to connect to that IP address via HTTPS and seeing what certificate gets served. Here's an example: https://138.68.161.203/ https://138.68.161.203/ > Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 138.68.161.203. The certificate is only valid for the following names: exhaust.lewiscollard.com, www.exhaust.lewiscollard.com

jchw 2y ago
I don't think that does you any good for Cloudflare, though. They will definitely be using SNI.
- kelnos 2y ago
  That doesn't really matter, though. While OP is using Cloudflare, the actual server behind it is still a publicly-accessible IP address that an IPv4 space scanner can easily stumble upon.
  - jchw 2y ago
    I misunderstood, I thought the subdomain was an R2 bucket. If it's just normal Cloudflare proxying to some backend this is probably the most likely answer. That said, while I think it's not the case here, using Cloudflare doesn't mean the underlying host is accessible, as even on the free tier you can use Cloudflare Tunnels, which I often do.
    - ratg13 2y ago
      they only state they are using cloudflare for DNS, they didn't say if they were proxying the connection
      - jchw 2y ago
        Also a valid point. I guess without more details all we can really do is speculate about the exact setup. That said, I do now agree that the most likely answer is "the underlying host was accessible and caught by an IPv4 scanner" since well, that's pretty much what it says anyway.
- deleted 2y ago
  [deleted]

melevittfl 2y ago

But there's no evidence in the OP's post that they have, in fact, discovered the domain. The only thing posted is that there is a GET request to a listening web server. The OP and all the people talking about certificates are making the same assumption. Namely that the scanning company discovered the DNS name for the server and tried to connect. When, if fact, they simply iterate through IP address blocks and make get requests to any listening web servers they find.

p0w3n3d 2y ago
OP states that the domain was discovered
- crazygringo 2y ago
  No they didn't. They said "How did the internet find my subdomain?" They're assuming the internet found their subdomain. They don't provide any evidence that happened, just that they found their IP address.
deleted 2y ago
[deleted]
denysvitali 2y ago
I really doubt CloudFlare gives them an IPv4 and they can see all the logs for said IPv4

paxys 2y ago

> When doing HTTP request to IP you specify the domain you want to connect to No, you make HTTP requests to an IP, not a domain. You convert the domain name to an IP in an earlier step (via a DNS query). You can connect to servers using their raw IPs and open ports all day if you like, which is what's happening here. Yes servers will (likely) reject the requests by looking at the host header, but they will still receive the request.