[Kikawala]

Is it available under HTTPS? Then it's probably in a Certificate Transparency log.

[govideo]

Yes, https via cloudflare's automatic https. Thanks for the info.

[snailmailman]

Yeah this is a surprisingly little known fact- all certs being logged means all subdomain names get logged.

Wildcard certs can hide the subdomains, but then your cert works on all subdomains. This could be an issue if the certs get compromised.

Usually there isn’t sensitive information in subdomain names, but i suspect it often accidentally leaks information about infrastructure setups. "vaultwarden.example.com" existing tells you someone is probably running a vaultwarden instance, even if it’s not publicly accessible.

The same kind of info can leak via dns records too, I think?

[thisisgvrt]

Automated agents can tail the certificate log to discover new domains as the certs are issued. But if you want to explore subdomains manually, https://crt.sh/ is a nice tool.

[yatralalala]

If you're using infra in a way [cloudflare -> your VM] I'd recommend setting firewall on the VM in a way that it can be accessed only from Cloudflare.

This way, you will force everyone to go through Cloudflare and utilize all those fancy bot blocking features they have.

[system2]

Do you know how to access these logs?

[daneel_w]

https://crt.sh/ is one example, if you sign using e.g. Let's Encrypt.

[Kikawala]

Answered below, but https://crt.sh/ is what I use.

[Eikon]

https://www.merklemap.com/