Forum Moderators: phranque
From your host name or Ip address, do a whois.com lookup. the unix host command will also give you different into. Also put the host name or Ip address into a google search.
Whois lists the domain owner's information on file at your domain registrar. I noticed my registrar is still offering privacy as a paid service, but the details publicly available depend on the country. Since GDPR went into effect earlier this year some of that information is less available except for certain purposes (such as legal). That is something that can depend on where you live and where you register domains.
Have you considered restricting access via passwords, cookies or IP restrictions?
I would like to better understand how someone can do reconnaissance on me by simply knowing my domain name or IP addrss.
Switch your site to HTTPS by adding a TLS (SSL) certificate and making your file paths secure then add HTTPS Security Headers [webmasterworld.com] to stop cross domain info scraping.
From your IP address I will be able to find out your host provider, regardless of your domain name registrar, which I should be able to find as well.
If you are on a shared server I will be able to find out other sites on your server.
If you provide a tech contact email address and or your name I should be able to find your other sites as well. This is all open to all. With a little bit of Googlefu all this is possible.
There are open source hacking tools, which I have mentioned in past discussions, that I can use to scan your site for vulnerabilities (reconnaissance). Scanning for vulnerabilities is not illegal.
Once I have a list of vulnerabilities I can look up in a database, conveniently included in the tool, on how to hack your site. It is the hacking part, the attemped breaking into your site, that is illegal.
Some CMS have better security than others. Wordpress is by far the worst. As a WP site user and owner I need to work hard to defend my and my customer's sites. With a WP target I can scan the site with another tool and get a list of login IDs. From there my hacking tool can use an external password file to try to hack into one or all of the IDs I found.
If you are concerned you need to do more research. Two factor authentication will go a long way in preventing a hack.
These tools are out there. They are open source and free. People are using them daily against sites, I see them daily in my logs and shut them down. There is really nothing you can do to prevent someone from Russia, China, US from doing reconnaissance on your site.
Yes it does. It's one way your info is scraped.
Server type, server version, server IP address, domain name, other domains hosted on server, etc.
If I register a new domain tomorrow from my registrar using the "privacy" option, won't that keep my personal details offline forever?
It's the security headers that stop cross-domain info scraping. However, the headers can only be used on a secure site.
Yes the security certificate does have your domain name assigned, but that doesn't reveal any more info than someone would already have being on the site to read that certificate.
However, the bottom line is... you are obliged to reveal a certain level of SPI (sensitive personal information) by having a website on the internet. Someone motivated enough can discover most anything by combining a little info from various sources.
"Forever" is a word which doesn't exist, especially on the Internet. The day after tomorrow, the registrar can have a bug and accidentally expose information which were supposed to be hidden,... the registrar can also be hacked, and information stolen,... etc...
As about hiding your IP and other sites you are running at your VPS, you can use Cloudflare as a frontend.
