[gitgud]

Wait, so bots watch for new records added to this HTTPS cert public ledger, then immediately start attacking?

To me that sounds like enabling HTTPS is actually a risk here…

[yjftsjthsd-h]

The server was already exposed. All this does is remove obscurity

[dijit]

I wish this trend of “security through obscurity” should mean that all info should just be exposed would die, its silly and lacks basis in reality.

Even within infosec, certain types of information disclosure are considered security problems. Leaking signed up user information or even inodes on the drives can lead to PCI-DSS failures.

Why is broadcasting your records treated differently? Because people would find the information eventually if they scanned the whole internet? Even then they might not due to SNI; so this is actually giving critical information necessary for an attack to attackers.

[homebrewer]

IME, moving ssh off the standard port reduces bot scanning traffic by >99%. Not only it means less noise in the logs (and thus higher SNR), but also lowers the chance you're hit by spray-and-pray in case there's a zero day in sshd (or any other daemon really).

[afavour]

Which is something that makes a notable difference. It’s telling the bots the OP listed are trying Vite endpoints, they’re targeting folks doing short term local web development. Removing obscurity and indicating relative likelihood of still being online is a big shift.

[moontear]

Yes. Yes, of course they do. Check for example https://crt.sh with your domain name to see the glorious public history of everything the certificates tell about your domain.