Selfhosted

Chrome: Sees new website domain

Google: 👀

Crawlers typically crawl by ip.

Are u sure they just not using ip?

U need to expressly configure drop connection if invalid domain.

I use similar pattern and have 0 crawls.

Maybe using subfinder?

If you have browser with search suggestions enabled, everything you type in URL bar gets sent to a search engine like Google to give you URL suggestions. I would not be surprised if Google uses this data to check what it knows about the domain you entered, and if it sees that it doesn't know anything, it sends the bot to scan it to get more information.

But in general, you can't access a domain without using a browser which might send that what you type to some company's backend and voila, you leaked your data.

Maybe that particular subdomain is getting treated as the default virtual host by Apache? Are the other subdomains receiving scans too?

I don't use Apache much, but NGINX sometimes surprises on what it uses if the default is not specifically defined.

A long time ago, I turned a PC in my basement into a web server. No DNS. Just a static IP address. Within 15 minutes, the logs showed it was getting scanned.

SSL encrypts traffic in-transit. You need to set up auth/access control. Even better, stick it behind a Web Application Firewall.

Or set up a tunnel. Cloudflare offers a free one: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/

I run my webservers behind a pfsense firewall with ssl offloading(using a wildcard cert) with a static IP and use Haproxy to have sub-domain's go to individual servers. Even though I've seen my fair share of scans, I only ever expose port 443 and keep things updated.

Recently though someone on here mentioned routing everything over Tailscale via a VPS. I didn't want to pay for a VPS and frankly can't even find one that is reasonably priced in the US(bandwidth limits mainly), so I threw Tailscale onto my pfsense, setup split-dns on Tailscale's admin panel with my domain name, and then reconfigured Haproxy to listen on my Tailscale interface. Even got IPv6 working(huge pain due to a bug it seems). Oh and setup pfblocker.

My current plan is I'm going to run my webservers behind Tailscale and keep my game servers public and probably segment those servers to a different vlan/subnet/dmz/whatever. And maybe just have a www/blog landing page that is read only on 443 and have it's config/admin panel accessible via my tailscale only.

Anyway, back on topic. I run my game servers and I don't advertise them out anywhere(wildcard cert) and do whitelist only, yet I still see my minecraft servers get hit constantly on port 25565.

So not much you can do except minimize exposure as much as possible.

if you use Let’s Encrypt (ACME protocol) AFAIK you can find all domains registered in a directory that even has a search, no matter if it’s wildcard or not.

It was something like this https://crt.sh/ but can’t find the site exactly anymore

LE: you can also find some here https://search.censys.io/

For anyone who needs to read it: At the end of the day this is obscurity, not security; however obscurity is a good secondary defense because it buys time.

I too would be interested to learn how this leaked

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

5 acronyms in this thread; the most compressed thread commented on today has 14 acronyms.

[Thread #990 for this comm, first seen 11th Jan 2026, 01:25] [FAQ] [Full list] [Contact] [Source code]

Reverse DNS? Or vuln scans just hitting IPs. Don't need DNS for that.

Do post again if you figure it out!

We're always watching.

You say you have a wildcard cert but just to make sure: I don't suppose you've used ACME for Letsencrypt or some other publicly trusted CA to issue a cert including the affected name? If so it will be public in Certificate Transparency Logs.

If not I'd do it again and closely log and monitor every packet leaving the box.

All the obvious things have been mentioned.

The only way to identify the problem is to share the exact steps youve followed and then others can reproduce.

Based on what youve told us, no one knows how the subdomain is leaked. Without meaning to be derisive, that suggests that something youve told us isn't quite correct.

Did you yourself make a request to it or just set it up and not check it? My horrifying guess it that if you use SNI in a request every server in the middle could read the subdomain and some system in the internet routing is untrustworthy.

Are you sure they're hitting the hostname and not just the IP directly?

https://www.namesilo.com/blog/en/dns/passive-dns-explained-domain-history

I believe that some DNS servers are configured to allow zone transfers without any kind of authentication. While properly configured servers will whitelist the IPs of secondaries they trust, for those that don't, hackers can simply request a zone transfer and get all subdomains at once.

You need better logging. Try doing a packet capture with tcpdump then decrypt the HTTPS traffic. Because what you've described so far, especially before the edit makes no sense.

If you don't have a DNS record pointing the subdomain to the IP address of the server, it shouldn't be possible to resolve the IP for random Internet users. If this VHOST only exists in your Apache config file and nowhere else, it is private.

Scans from where? Is it exposed to the internet? What does the scan traffic look like?