I have a website -
www.example.com - which is listed on Google, domain verified in Search Console, sitemaps submitted, canonical urls all in line. This is my only domain that is "out there" in the wild.
www.example.com is configured in DNS using a CNAME which points to another domain, which finally points to an IP. As follows:
www.example.com -> CNAME = example.cloudhost.com -> A = 192.0.2.255
For dev/test/debugging reasons I have a binding on my web server which will respond to
example.cloudhost.com, which means if you navigate to any url on that domain, you'll get the exact same responses as
www.example.com, including all canonical tags pointing back to
example.cloudhost.com has not been published ANYWHERE on the Internet, let alone given directly to Google. It is not exposed via any html tags, sitemaps, Search Console submissions, social media posts, 3rd party websites. Nothing.
--- edit ---
I now realise it could be leaked via http referrer or analytics trackers running on
example.cloudhost.com when used for testing.
However, somehow Google has indexed
example.cloudhost.com as a duplicate domain to
How did Googlebot get hold of
example.cloudhost.com to start indexing it and is there any documentation of its methods? Does Googlebot look at DNS CNAME chains and speculatively try to crawl content on those intermediate domains?