Sure - telling me whether you have an api.<domain>.com doesn't matter. Anyone can scan and find that. But, if I know your database names (from a screenshot) and your hosting provider, I know that once I'm past a bastion host, or on your VPN connection - I don't have to wait to sniff or hope you connect to datasources. I now have an informed opinion on where to go.