Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: https://certificate.transparency.dev/
Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn’t get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.
You can use something like crt.sh to look up domains
That’s been happening since forever, though. I helped manage proxy servers for my first job in the mid 00’s, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.
I bought a domain, configured the webserver in the next 5m.
As soon as it started taking requests (on a domain that i haven’t even announced yet) it got flooded by bots.
Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: https://certificate.transparency.dev/
Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn’t get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.
You can use something like crt.sh to look up domains
Yeah I worked for company with publicly exposed server, the logs were amazing.
Just bots scanning default ports trying default username and password for services like Microsoft SQL server.
It’s such a waste of energy really
That’s been happening since forever, though. I helped manage proxy servers for my first job in the mid 00’s, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.
If your browser is based on chromium, you’re employing an army of bots yourself that gets enabled each time you enter any domain.
Can you explain what you mean exactly?