Re:Ask HN: How did internet discover my subdomain?
by pkulak on Friday March 07, 2025 @01:12AM
(#43287702)
Okay. But how did they get the proper host header?
[ Parent
| on HN ]
Re:Ask HN: How did internet discover my subdomain?
by peeters on Friday March 07, 2025 @01:17AM
(#43287720)
There are a couple easy possibilities depending on server config.
1. Not using SNI, and all https requests just respond with the same cert. (Example, go to https://209.216.230.207/ and you'll get a certificate error. Go to the cert details and you'll see the common name is news.ycombinator.com).
2. http upgrades to https with a redirect to the hostname, not IP address. (Example, go to http://209.216.230.207/ and you get a 301 redirect to https://news.ycombinator.com)
Re:Ask HN: How did internet discover my subdomain?
by INTPenis on Friday March 07, 2025 @01:21AM
(#43287736)
Could be a number of ways for example a default TLS cert, or a default vhost redirect.
I actually had a job once a few years ago where I was asked to hide a web service from crawlers and so I did some of these things to ensure no info leaked about the real vhost.