Hacker News Reader

Comment by mr_mitm | Hacker News Reader

Getting the domain name from the IP address is not trivial, though. In fact, it should be impossible, if the name really hasn't been published (barring guessing attempts), so OP's question stands.

View on HN

The OP is misunderstanding what's happened, based on what's been posted. The OP has a server with an IP address. They're seeing GET requests in the server's logs and is assuming people have found the server's DNS name.

In fact, the scanners are simply searching the IP address space and simply sending GET requests to any IP address they find. No DNS discovery needed.

Are you sure that’s the case? IP addresses != domain, so I’m getting bots are including the Host header in their requests containing the obfuscated domain.

My guess is OP is using a public DNS server that sells aggregated user requests. All it takes is one request from their machine to a public machine on the internet, and it’s now public knowledge.

That entirely depends on whether the GET requests were providing the (supposed to be hidden) hostname in the `Host` header (and potentially SNI TLS extension).

I had this issue with internal domains indexed by Google. The domains where not published anywhere by my company. They were dcanned by leakix.net which apparently scans the whole web for vulnerabilities and publishes web pages containing the domain names associated with each IP address. I guess they read them from the certificates

There is another source, SNI certs showing up on a server or load balancer during the TLS handshake. When the client tries to connect to a server using SNI without indicating the server, some will reply with a default or give a list of valid server names.

    $ host 209.216.230.207
    207.230.216.209.in-addr.arpa domain name pointer news.ycombinator.com.

Not sure what you are trying to tell me. This isn't guaranteed to work. If you define a reverse lookup record for your domain, then that counts as published in my book.

This is correct.

That is when there is an explicit PTR record, for instance one of my assigned addresses can be named that way due to:

    74.231.187.81.in-addr.arpa. 3600 IN PTR ns2.nogoodnamesareleft.com.

in the zone file for that IPv4, but unless they've explicitly configured, or are using a hosting service that does it without asking, this it won't be what is happening.

It isn't practical to do a reverse lookup from “normal” name-to-address records like

    ns2.nogoodnamesareleft.com. IN A 81.187.231.74

(it is possible to build a partial reverse mapping by collecting a huge number of DNS query results, but not really practical unless you are someone like Google or Cloudflare running a popular resolution service)

I love how the ARPANET still lives on through reverse DNS PTRs.

https://www.youtube.com/watch?v=V78GUSOS-EM

Reply on news.ycombinator.com