Hacker News new | ask | show | jobs
by t0mas88 1558 days ago
It could be doing reverse lookup on the IP you connected to? That's what a lot of network monitoring tools do.
1 comments

That's not as common any more, due to the broad adoption of TLS-capable CDNs (Cloudflare, Fastly, etc) over the past ~10 years.

In this case the site I tested with had a few different subdomains backed by the same IP, which I verified from a remote VPS. Using `curl` locally, with the `--resolve` flag to bypass DNS resolution, caused the router's log to contain entries for the specific subdomains requested.