Forty customer staging sites, none of them on Shodan

Every customer gets a staging copy of their deployment. Forty sites a scanner could find.

It finds none of them. A container has no dedicated public IPv4; its traffic is masqueraded behind the host. There is no port 22 to brute-force and no IP to put in a port scan. The URL is the only address, and the container ID inside it is 24 hex characters, 96 bits, no directory, no enumeration endpoint.

Then the quieter part. The default subdomains are covered by a wildcard certificate, so the hostnames never appear in Certificate Transparency logs. crt.sh has nothing to show. CNAME staging.acme.com to one and that name does show up, which is fine for the ones you mean to publish.

Forty staging environments, forty secrets that double as addresses. Recon needs a surface, and there isn't one.