1

I own a domain, and manage its DNS entries manually using godaddy.com.

I use IIS as my webserver, and it runs on an Azure server. I host several specific services there, and each is configured in IIS to require SNI for a specific URL.

I created a new DNS CNAME entry for my newest service (newservice.mydomain.com)

I then created a new site in IIS on the machine this CNAME ultimately points to requiring SNI with "host name" of "newservice.mydomain.com".

I also used Let's Encrypt to generate an SSL certificate for it.

The very next day, I see the service started at 3am. I checked the IIS logs and see three different IP addresses access my new site looking for static things that are not there. A query of the IP addresses shows that these source addresses accessing my site are "hosted" by alibaba.com.

Is it purely coincidence that someone attempted to reach this new URL? Is it possible or even likely I am or my webserver is being spied upon? I have two colleagues I'm working with, nobody else knows I've created this new URL and IIS site.

Here is more specific info from the IIS log...

#Software: Microsoft Internet Information Services 8.0
#Version: 1.0
#Date: 2023-08-24 07:01:44
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2023-08-24 07:01:44 192.168.x.x GET / - 443 - 47.88.87.97 Mozilla/5.0+(Linux;+Android+11;+M2004J15SC)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/103.0.5060.114+Mobile+Safari/537.36 - 404 0 0 2759
2023-08-24 07:01:45 192.168.x.x GET /Public/home/js/check.js - 443 - 47.89.193.162 Mozilla/5.0+(Linux;+Android+11;+M2004J15SC)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/103.0.5060.114+Mobile+Safari/537.36 - 404 0 0 155
2023-08-24 07:01:47 192.168.x.x GET /static/admin/javascript/hetong.js - 443 - 47.251.14.232 Mozilla/5.0+(Linux;+Android+11;+M2004J15SC)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/103.0.5060.114+Mobile+Safari/537.36 - 404 0 0 155
6
  • 1
    There is not really enough to go on. Your site is likely being spied on to the same degree most sites are (ie not specifically targetted, but lots of crap out there - probably someone looking for known vulnerabilites to attack). What is the default site that comes up (after ignoring the invalid cert message) that comes up when you enter the site by IP address? What are the Subject-Alt-Names on the cert?
    – davidgo
    Aug 24, 2023 at 21:52
  • Your logging doesn't include the domain name that was requested. Are you sure these hits include the domain name as opposed to just targeting the IP address? Aug 25, 2023 at 12:01
  • 2
    When you generate a new SSL certificate, it gets added to the public certificate transparency logs. Every subdomain you use with HTTPS is logged and discoverable publicly. Aug 25, 2023 at 20:33
  • @MaximillianLaumeister Great comment - I reccon it should be an answer. TIL...
    – davidgo
    Aug 26, 2023 at 1:23
  • Thinking out aloud - I know Wordpress can automatically reach out to search enginrs to advise of new pists and I think it does this by default. It is possible that yoy are running a framework that does this. See blog.hubspot.com/website/wordpress-ping-list for the kind of thong I'm talking about.
    – davidgo
    Aug 30, 2023 at 19:53

2 Answers 2

5

When you generate a new SSL certificate, it gets added to the public certificate transparency logs. Every subdomain you use with HTTPS is logged and discoverable publicly.

If you look up your domain using a certificate transparency log search engine such as crt.sh, it will show you the time and date of every instance where a certificate was issued or renewed for your domain.

It's likely that your visitor discovered your new subdomain by watching the certificate transparency logs, and decided to poke around to see if they could find a vulnerability.

1
  • 1
    Arguably a good strategy when you're probing for vulnerabilities, assume that a shiny new certificate also means a shiny new site that is more likely to be still pre-production. Probe for debug code/settings, default credentials, hope that access controls, other hardening measures and protections are (still) missing and haven't been set up yet. I can see such targeted approach working better for an attacker than just scanning random IP-ranges.
    – HBruijn
    Aug 27, 2023 at 11:11
-1

CNAMEs can be queried and a lot of entities, particularly those with malicious intent, will look for new ones. The malicious ones will start probing for common new setup vulnerabilities (your log looks like they attempted some Node.js vulnerability probing).

Unfortunately, that's the nature of all publicly accessible DNS records, someone is always digging through them.

7
  • 1
    I downvoted this because it appears wrong on the face of it. While DNS records (other then NS records) are not private, they are not advertised either. Someone would need to know the subdomain exists to get the CNAME record for it, and this answer does not appear to posit a method whereby the subdomain could be discovered.
    – davidgo
    Aug 30, 2023 at 3:26
  • It is not advertised, but it is still public, and it is queryable. There are limits on what you can query based on the type of entry, but there are even CNAME lookup sites that do it for you. An administrator CAN limit zone transfer, but even that's not a guarantee. The SSL answer above may be correct in his situation, but even with a wildcard SSL cert, mapping a subdomain to the same IP address as the domain, and zone transfer limits, it can still be found before it's made public.
    – Merennulli
    Aug 30, 2023 at 17:57
  • Nothing you have said above reveals how the subdomain may have been discovered. which was the question. Also, a wildcard cert is does not reveal the associated subdomains....
    – davidgo
    Aug 30, 2023 at 19:31
  • Intercepting zone transfers - in the precious few cases this is possible - shpuld only be possible by TLA's and entities who can intercept the packets - ie entities who are unlikely to announce their capabilities by spidering the web - and most transfers on longer use the ancient bind master/slave setups anyway - even less so over the unencrypted public Internet.
    – davidgo
    Aug 30, 2023 at 19:36
  • 1
    As to how to discover a subdomain, here is another stack question where that has been answered already: security.stackexchange.com/questions/35078/…
    – Merennulli
    Aug 30, 2023 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.