0

Just today I'm migrating some of my webpages to a new server. After a couple hours the services was ready, I set up a hosts file with my domain example.com pointing to the server address, went to my browser and navigated to the domain and all worked ok. Just before I made the new server public (by changing the DNS) I noticed two requests in the nginx log comming from different IPs to my own:

184.105.139.67
176.58.124.134

By curiosity I went to that address in my browser and both says that they are from bots that scans services (tequilaboomboom and shadowserver). OK, but... how did they know the domain? The server is public and people can go to the IP address, but my nginx log is specific for my domain example.com. I only have React extension on my W10 Chrome browser. How did they catch my request to know what site to scan? Am I being spied on? Is my machine compromised? Is my network compromised?

Improve this question
3
  • Sure you don't have defualt_server on that server block in the NGINX configuration? I suspect that there is nothing fishy going on, and that they simply scanned the IP. Instead, maybe the NGINX server isn't logging the way you thought.
    – Anders
    Commented Mar 4, 2020 at 8:19
  • You could check this is you have the host header in the logs. Or access the server through the IP and see if your requests end up in the log.
    – Anders
    Commented Mar 4, 2020 at 8:19
  • pretty sure! default_server has its own log file,
    – Jassiel Díaz
    Commented Mar 4, 2020 at 21:24

1 Answer 1

Reset to default
1

There is are multiple reasons why this can happen. As some poeple stated in the comment, its possible that a misconfiguration in the nginx lead a request to end up in your virtual hosts, simply, because of how the requests are processed. It's hard to tell without the config and detailed logs.

An other thing might be that you are leaking information, somehow. For example, error message of if your defualt_server coudl leak a hostname or a redirect (to a canonical site or the standard http to https redirect) can also be a s possible leak of your actual site name.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .