Unwanted API Hit After Adding New Subdomain

[eucheckout]

After creating new subdomain in a Express JS server, auto api hitting when nobody knows that subdomain. it's newly created fresh domain.

I think you need to fix this asap.

[djsisson]

bots scan certificate transparency logs for newly issued tls certs, so they know it exists within a few minutes, then you get spammed by bots looking for weak security / env etc
you can use an external firewall like cf bot protection + waf rules, or use something like fail2ban/crowdstrike traefik plugins internally