How are people discovering random subdomains on my server?

⁨196⁩ ⁨likes⁩

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨BonkTheAnnoyed@lemmy.blahaj.zone⁩ to ⁨selfhosted@lemmy.world⁩

I generated 16 character (upper/lower) subdomain and set up a virtual host for it in Apache, and within an hour was seeing vulnerability scans.

How are folks digging this up? What’s the strategy to avoid this?

I am serving it all with a single wildcard SSL cert, if that’s relevant.

Thanks

Comments

Sort:hotnew top

BootLoop@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
Did you generate a DNS A record for the subdomain?

source
- BonkTheAnnoyed@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago
  Nope
  
  source
waggz@programming.dev ⁨1⁩ ⁨day⁩ ago
if there’s no dns entry do you mean you are getting scans to your ip with these random subdomain headers? so someone would need both pieces of information? curious

source
- BonkTheAnnoyed@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago
  Yes, exactly. Super weird, shouldn’t happen. I wonder if I have a compromised box somewhere…
  
  source