I haven’t tried it myself, but yeah woes in the street is that it works if you enable enough permissions on play services and whatnot.

No Google required! :-)

Though you can enable / install a sandboxed Google play services and mirrored app store, and starve them of permissions except for what/when you absolutely require.

GrapheneOS lets you add “profiles” – essentially separate user accounts, and switch between them. Many folks put any Google stuff on a separate profile and otherwise stay on the surveillance free side.

You’ll want to install Obtainium and probably f-froid, to find all the open source apps you’re after.

Used pixel + GrapheneOS. Takes some getting used to, but most stuff works as expected. The default apps aren’t pretty, but ithe Fossify alternatives are a little nicer.

You’re leaving a whole ecosystem meant to work seamlessly without having to understand how it works, so be prepared for that…

The funniest part is how many people have self identified as block-me in the replies to this comment.

Such an excellent thread for filling out my block list

That’s handy – thanks!

Well, the good news is that I at least think I’m doing all the right things.

I’ll spin up a new VM tomorrow and start from scratch.

It’s literally just a VM hosting Apache and nothing else.

I mean, it could be… I’ll try it with a 128 char base 52 name and see what happens

Yes, exactly. Super weird, shouldn’t happen. I wonder if I have a compromised box somewhere…

The random name is not in the public log. Someone else suggested that earlier. I checked CRT.sh and while my primary domain is there, the random one isn’t.

Previous experiments, yes, I sent a request. The random one, no.

As expected, it doesn’t show up. I had a couple of other subdomains configured before I switched to wildcard, but nothing matches the random one

Will do!

Shows up by name in the apache other_hosts…log, so yes

Nope, but that’s a good suggestion. I set this one up brand new for the experiment.

Mostly from AWS or the like, with occasional Chinese and Russian origins.

The scans look like requests to various WordPress endpoints, JavaScript files associated with known vulnerabilities etc

Even with a wildcard cert?

Yeah, this is interesting, I’ll dig more into this direction.

But the randomly generated subdomain has never seen a DNS registrar.

I do have *.mydomain.com registered though…hmmm

Nope