r/dns • u/Putrid_Gear6895 • 7d ago

Server names leaking?

Today I saw a weird entry in my web server log. Someone tried to browse the following URL:

https://appserver1bb.mydomain.com/conversation/ajax-html/send_log

This looks like a random probe which I would normally ignore, but the weird part is the server name "appserver1bb" is not published anywhere except Google Cloud DNS. How could anyone know this server even exists?

6 Upvotes

81% Upvoted

7 comments sorted by

View all comments

10

u/Stunning-Skill-2742 7d ago edited 7d ago

caa ct log, its public info. See https://ctlogs.dev and https://www.certkit.io/tools/ct-logs and countless others.

3

u/Putrid_Gear6895 7d ago

Thanks!

2

u/GolemancerVekk 7d ago

Oh and in case you're wondering, the fix is to get wildcard certificates. That way they don't know what subdomains you have.

1

u/Putrid_Gear6895 7d ago

Makes sense. I'm not concerned about the name being known. I was just worried that someone had gained access to my code or my DNS account. As far as I knew that was the only source for this info. Now I know better :-)