Someone else's DNS
A fresh cloud address received 157 web requests carrying the host header of a shop domain it does not own, from 15 networks, most with no user agent at all. The DNS record still points at the new tenant. The paths requested are not pages but PHP files by name, which is what people knock on when they are looking for backdoors they left on the old site.
A domain I do not own points at my server.
A fresh cloud address feels anonymous. Nothing hosted, nothing registered, no name attached to it yet.
In one day this address took five hundred and forty-three web requests. A hundred and fifty-seven of them carried a host header for a shop domain that is not mine.
Its record still points here, through a registrar I have no account with. Fifteen different networks sent them, and a hundred and two arrived with no user agent at all.
They are not asking for the front page. They ask for specific PHP files by name. Those are not pages. Those are backdoors somebody left behind.
The address was recycled. The previous tenant’s name still resolves to it, and the people who had broken into that site are still knocking.
A new IP is not a clean one. Check what already resolves to it.
#linux#security#dns#infosec#sysadmin
❯ A new IP is not a clean one. Check what already resolves to it.