My workers are receiving a lot of spam lately on the workers.dev routes. Should they be disabled or is there a better way to handle it?
#workers.dev spam
storm dragon
rigid merlin
Disabling is the best way.
It is because bots scrape the certification issue list so they see the ones issued to your dev domain
storm dragon
Ok, thanks. That was my guess. I could not see the FQDN in the TLS certificate. But maybe I looked in the wrong place.
storm dragon
The TLS certificate does not contain the FQDN. So somebody thought about this but then something happend.
untold swift
The TLS certificate does not contain the FQDN. So somebody thought about this bu...
what are you talking about? There's a unique wildcard cert for every worker, here's a few examples: https://crt.sh/?q=tylerobrien.workers.dev
storm dragon
Yes, that is my conclusion too. So, the FQDN is not in the public certificate. But then there is an ordering process... Maybe the theory is a wild goosechase but somehow bots are finding the FQDN for my workers.