131–140 of 322 posts
Earlier quoted context omitted.
Getting the domain name from the IP address is not trivial, though. In fact, it should be impossible, if the name really hasn't been published (barring guessing attempts), so OP's question stands.
$ host 209.216.230.207 207.230.216.209.in-addr.arpa domain name pointer news.ycombinator.com.
Earlier quoted context omitted.
I don't think that does you any good for Cloudflare, though. They will definitely be using SNI.
That doesn't really matter, though. While OP is using Cloudflare, the actual server behind it is still a publicly-accessible IP address that an IPv4 space scanner can easily stumble upon.
That said, while I think it's not the case here, using Cloudflare doesn't mean the underlying host is accessible, as even on the free tier you can use Cloudflare Tunnels, which I often do.
Not sure why everyone is going on about certificate transparency logs when the answer is right there in the user agent. The company is scanning the ipv4 space and came upon your IP and port.
That perfectly fits midwit meme. Lots of people are smart enough to know transparency logs - but not smart enough to read OP post and understand the details.
The only proper response to OP's question is to ask for clarification: is the subdomain pointing to a separate IP? Are the logs vhost-specific or not?
If you don't get the answers, all you can do is to assume, and both assumptions may end up being right or wrong (with varying probability, perhaps).
2) Are you using TLS? Unless you are using a wildcard cert, then the FQDN will have been published as part of the certificate transparency logs.
https://pentest-tools.com/information-gathering/find-subdoma...
Earlier quoted context omitted.
It's rather hilarious that nobody mentioned this in 7 hours. What am I missing? ~5 billion scans in a few hours is nothing for a company with decent resources. OP: in case you didn't follow, they're literally trying every possible IPv4 address and seeing if something exists on standard ports at that address. I believe it would be harder to find out your domain that way if you were using SNI and only forwarded/served…
> What am I missing? It's very common for people to read only up to the point they feel they can comment, then skip immediately to the comment. So, basically, noone read it.
The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many others.
Security by obscurity does not work. You can not rely on "people won't find it". Once it's online, everyone can find it. No matter how you hide it.
Earlier quoted context omitted.
Getting the domain name from the IP address is not trivial, though. In fact, it should be impossible, if the name really hasn't been published (barring guessing attempts), so OP's question stands.
$ host 209.216.230.207 207.230.216.209.in-addr.arpa domain name pointer news.ycombinator.com.
74.231.187.81.in-addr.arpa. 3600 IN PTR ns2.nogoodnamesareleft.com.
It isn't practical to do a reverse lookup from “normal” name-to-address records like
ns2.nogoodnamesareleft.com. IN A 81.187.231.74