Submitted 1 month ago by BonkTheAnnoyed@lemmy.blahaj.zone to selfhosted@lemmy.world
I generated 16 character (upper/lower) subdomain and set up a virtual host for it in Apache, and within an hour was seeing vulnerability scans.
How are folks digging this up? What’s the strategy to avoid this?
I am serving it all with a single wildcard SSL cert, if that’s relevant.
Thanks
If you do a port scan on your box, what services are running? Maybe something like email or diagnostics is exposed to the internet and announcing subdomains?
It’s literally just a VM hosting Apache and nothing else.
Did you generate a DNS A record for the subdomain?
Nope
if there’s no dns entry do you mean you are getting scans to your ip with these random subdomain headers? so someone would need both pieces of information? curious
Yes, exactly. Super weird, shouldn’t happen. I wonder if I have a compromised box somewhere…
FukOui@lemmy.zip 1 month ago
Following this thread!
Stupid question, but are you somehow publicly exposing your vhost config (or a bak file of it)?