It's a little funny to me you added a literal tracking pixel to your website from a VPN company and then came to HN to preach that you don't do any tracking That said, due to third party cookie changes, tracking pixels have very limited usefulness these days and it's unlikely it actually tracks people over a full 1 day period
I guess you're right.. And indeed, browsers fight back: https://blog.mozilla.org/security/2021/01/26/supercookie-pro...
Someone on Reddit asked how I make a living. Might be interesting for folks here too. Right now, we're living off our savings and my wife's salary. Both sites are already profitable, though. I've recently launched an API for NsLookup, which now generates around 100 USD / month, and both sites have ads that generate income. Not enough to replace my salary yet, but I'm confident I can increase it over time. Ads have a…
FYI, WhoIsMyISP.org tells me the name of my city is my ISP, "also known as" the actual ISP name.
Your traffic is incredible. I would work to understand the business use cases better and create a B2B niche service tailored specifically to one or more of those (API, more detailed info, custom solution, etc.). I don't know that growing your traffic overall needs to be a target. Rather, catering to an existing segment and/or growing that segment may be a better use of time and resources.
I do understand all of that, still it feels weird to me. If I'm looking up a staging domain I'm not trying to broadcast that to the world, for example You know the Qualsys SSL Tester tool? That has a checkbox about making the result public or not and that is because by default people wouldn't expect the domain to be leaked (even though it's already public information that doesn't really matter)
I agree with you completely. I just want to add for people that do care about domain privacy that there's many certificate provider that do publish the generated certificate over https://crt.sh/ . I did find a few staging subdomains in the past on that website.
As a side-note, as soon as I added some DNS A records pointing to a testing server, it started getting spammed by bots trying to hack into the server (accessing all sorts of random paths that might be exposed, like .env or common PHP files). Not sure what the solution to this is, apart from not adding DNS records for testing servers, maybe only allow access to the server from specific IPs? But that makes testing harder, if you send a link to someone with a dynamic IP.
It's so nice to see these examples are increasing every now and then. Hope to learn a lot and I also would like to know about the use cases of nslookup dot io. One thing that's coming out of my head would be if I would ought to make a non-targeting crawler of some sort and not implement my own dns crawling infrastructure and just use nslookup.io and just cache the results.
I agree with you completely. I just want to add for people that do care about domain privacy that there's many certificate provider that do publish the generated certificate over https://crt.sh/ . I did find a few staging subdomains in the past on that website.
As a side-note, as soon as I added some DNS A records pointing to a testing server, it started getting spammed by bots trying to hack into the server (accessing all sorts of random paths that might be exposed, like .env or common PHP files). Not sure what the solution to this is, apart from not adding DNS records for testing servers, maybe only allow access to the server from specific IPs? But that makes testing hard…
I'd be surprised if it was caused by adding the DNS record, and not for example you visiting the test site. In any case, sooner or later those attacks will come, so omitting a DNS A record won't cure it.
It's so nice to see these examples are increasing every now and then. Hope to learn a lot and I also would like to know about the use cases of nslookup dot io. One thing that's coming out of my head would be if I would ought to make a non-targeting crawler of some sort and not implement my own dns crawling infrastructure and just use nslookup.io and just cache the results.
If you like these kinds of stories, check out indiehackers.com. I took a lot of inspiration from them, and was part of the reason I made the jump.