following up on my previous post:

it turns out that, like anything else weird in infrastructure, it was DNS

I registered mydomain.com as my primary router’s domain, re-ran the experiment with a fresh 128 char subdomain, and I received zero scans on the new domain.

Now my question is, who’s making that one query that leaks my domain name? Is it Apache on startup?

One solution is to resolve all my subdomains on /etc/hosts so it never has to leave the box, but I’m curious what a more experienced net admin would suggest.

  • tal@lemmy.todayEnglish
    3·
    22 hours ago

    Now my question is, who’s making that one query that leaks my domain name? Is it Apache on startup

    If you’re wanting a list of DNS queries from your system, assuming that it’s DNS and not DoH, maybe:

    # tcpdump port domain

    Then go start Apache or whatever.