# RedAmon vhost-common.txt # Curated hostname prefixes for VHost & SNI enumeration. # Each entry is a label that the module expands as {prefix}.{target_apex} # Lines starting with # and blank lines are ignored. # ~1100 high-signal patterns: admin/dev/staging/internal/modern-stack. # === Admin / management surfaces === admin admin1 admin2 admins administration administrator administrators admin-panel adminpanel admin-portal admin-console admin-dashboard admin-api admin-ui admin-web admin-internal admin-private admin-secure admin-old admin-new admin-test admin-dev admin-staging admin-prod admin-beta admin-v1 admin-v2 adm adminer sysadmin superadmin super manager manage management mgmt mgr console control controlpanel control-panel cpanel plesk webmin directadmin ispconfig confixx froxlor vestacp hestiacp ispmanager panel backend back-office backoffice back dashboard dash portal home internal intranet extranet private privado secure secured restricted internal-only employees-only employee employees staff staff-only hr finance accounting billing payroll legal compliance audit operations ops helpdesk support-internal crm erp sap oracle-erp netsuite workday salesforce-internal sf-admin admincp acp modcp moderator mod root rootadmin master master-admin god godmode # === Dev / staging / pre-prod === dev dev1 dev2 dev3 develop developer developers development devops devbox devel dev-internal dev-private staging stage staging1 staging2 stg stg1 stg2 test tests testing test1 test2 test3 testbox test-env testing-env qa qa1 qa2 quality quality-assurance uat uat1 uat2 preprod pre-prod pre-production preproduction preview previews prevu prev beta beta1 beta2 betas alpha alpha1 alpha2 alphas sandbox sand demo demo1 demo2 demos showcase showroom lab labs experimental experiments incubator canary canaries rc release-candidate nightly nightlies internal-dev local localhost loc proto prototype mock mockup spike poc pilot trial trials draft drafts edge edge1 edge2 unstable stable release releases release-staging release-prod # === CI/CD / build / deploy === jenkins jenkins-internal jenkins-master jenkins-slave build builds build-server build-master build-agent ci ci1 ci2 ci-cd cicd cd continuous gitlab gitlab-ci gitlab-runner gitlab-internal github-actions github-runner gitea codeberg forgejo bitbucket bitbucket-server stash gerrit phabricator travis travis-ci circleci circle drone drone-ci woodpecker teamcity tc bamboo buildbot buildkite semaphore appveyor azure-devops azure-pipelines azuredevops codepipeline codebuild codecommit codeship spinnaker spin argocd argo argo-cd argo-workflows flux fluxcd helm helm-chart chartmuseum nexus nexus-repo nexus-rm artifactory artifacts artifact maven maven-repo npm-registry npm-internal pypi-internal docker-registry registry registry-internal harbor quay ecr gcr acr deploy deployment deploy-server release-server deployments sonar sonarqube sonarcloud fortify checkmarx veracode codacy snyk mend whitesource # === Modern stack: monitoring / logging === grafana grafana-internal prometheus prom alertmanager alerts alerting loki tempo mimir thanos victoria victoriametrics elasticsearch elastic es es-cluster opensearch kibana kibana-internal kib opensearch-dashboards osd filebeat metricbeat packetbeat heartbeat auditbeat logstash fluentd fluent-bit fluentbit vector graylog graylog-server splunk splunk-internal splunk-search splunk-hec datadog dd new-relic newrelic nr sentry sentry-internal rollbar honeycomb papertrail loggly sumologic solarwinds observium librenms zabbix zabbix-server nagios nagios-internal icinga icinga2 checkmk prtg opsview op5 cacti munin collectd telegraf influxdb influx chronograf kapacitor statsd statsite opentsdb graphite graphite-web metrics metrics-internal metric monitoring monitor mon healthcheck health status statuspage status-page ping uptime uptimes uptimerobot oncall pagerduty opsgenie victorops xmatters trace traces tracing jaeger zipkin opentelemetry otel otel-collector # === Modern stack: containers / orchestration === kubernetes k8s k8s-master k8s-api k8s-dashboard kube kubectl kubeconfig kube-api kube-apiserver kube-control-plane kubelet kube-proxy etcd master-node worker-node control-plane rancher rancher-server rancher-agent openshift ocp oc mesos marathon chronos nomad swarm docker-swarm docker docker-internal docker-host portainer portainer-internal yacht dockge container containers runtime podman crio containerd docker-machine helm-repo chartrepo prometheus-operator operator operators ingress ingress-controller ingress-nginx nginx-ingress traefik istio istio-ingress linkerd consul-connect envoy contour ambassador emissary kong kong-admin kong-api gloo solo tyk tyk-dashboard tyk-gateway apigee apigee-edge apigee-portal # === Modern stack: databases / caches === mysql mariadb percona postgres postgresql pg pgsql psql mssql sqlserver sql oracle oracledb db2 sybase firebird sqlite mongodb mongo mongo-cluster couchdb couchbase cassandra scylla hbase dynamodb cosmosdb documentdb redis redis-cluster memcached memcache elasticache hazelcast ignite keydb dragonfly clickhouse duckdb snowflake bigquery redshift synapse databricks neo4j neo4j-browser arangodb janusgraph orientdb nebula dgraph tigergraph influxdb timescaledb questdb victoriametrics-db warp10 crate cratedb cockroachdb cockroach yugabyte yugabytedb spanner fauna faunadb phpmyadmin pma adminer sqlbuddy heidisql dbeaver pgadmin pgadmin4 mongo-express redisinsight redis-commander chronograf-ui kafka kafka-connect kafka-rest confluent schema-registry ksql ksqldb zookeeper zk rabbitmq rabbit rmq activemq amq artemis nats nats-server pulsar apache-pulsar qpid mqtt mosquitto emqx hivemq solace # === Modern stack: CI tools / repos / packaging === sonatype sonatype-nexus sonatype-iq sonatypeiq nexusiq artifactory-pro xray mission-control distribution-edge fortifyssc black-duck blackduck synopsys mend-renovate renovate dependabot gemnasium deps dependency licensee # === Internal services === helpdesk support ticketing ticket tickets servicedesk service-desk otrs osticket zendesk-internal zammad freshdesk freshservice glpi itop jira jira-internal jira-software confluence confluence-internal servicenow remedy remedyforce manageengine spiceworks solarwinds-helpdesk wiki wikipedia wikis mediawiki dokuwiki xwiki bookstack bookstacks outline slate gitbook notion-internal notes notepad gollum fossil phabricator-projects phab yourls shorten shorturl links link url urlsh shrt shr go goto golinks links-internal intranet-links b bookmark bookmarks # === Cloud / infrastructure / hosting === aws aws-internal ec2 ec2-internal s3 s3-internal s3-bucket s3-buckets elb alb nlb vpc iam cloudfront cloudwatch gcp google-cloud gke gcs gce azure azure-internal aks aci acr arm oraclecloud oci heroku-app herokuapp linode digitalocean do vultr hetzner ovh ovhcloud scaleway upcloud exoscale hosting hosted host hosts server servers srv machine machines node nodes vm vms vps cloud cloud-internal cloud-services cloud-platform private-cloud public-cloud hybrid-cloud infra infrastructure network networks net internal-network corp-network mgmt-network oob out-of-band ipmi idrac ilo oob-mgmt console-mgmt serial serial-console kvm kvm-over-ip ipkvm remote remote-access remote-mgmt emergency-access # === Authentication / SSO / IAM === auth authn authz auth-server auth-internal authentication authorization sso sso-internal saml saml-idp oauth oauth-server oidc openid keycloak keycloak-internal authentik authelia oauth2-proxy oauth-proxy hydra ory casdoor fusionauth boxyhq gluu shibboleth adfs ad-fs ad-cs adcs ad activedirectory active-directory ldap ldap-internal ldaps freeipa ipa identity identities identity-provider idp identity-server okta okta-internal auth0 ping-federate pingfederate pingone oneidentity onelogin miniorange gluufederation forgerock duo duosecurity yubikey-server totp mfa 2fa authenticator vault hashicorp-vault vault-internal secrets secrets-manager secret keystore keyserver key-server ca ca-internal cert certs certificates certificate-manager acme acme-server stepca step-ca smallstep boulder cfssl # === Email / communication === mail email mx mx1 mx2 mx3 mta smtp smtp1 smtp2 smtp-relay smtp-internal imap imap-internal pop pop3 pop3-internal exchange exchange-internal ews ecp owa outlook outlook-internal mail-server zimbra zimbra-admin roundcube roundcubemail horde squirrelmail icewarp mailcow mailu mailinabox postfix postfix-admin postfixadmin dovecot sendmail courier mailman mailman3 sympa listserv googlegroups mailing-list newsletter campaign campaigns mautic mailwizz acelle mailtrain mailpoet phplist sendgrid-internal ses-internal mandrill mailgun mailjet postmark sparkpost elasticemail amazonsesinternal chat slack-internal mattermost mattermost-server rocketchat rocket-chat zulip matrix synapse-matrix element riot gitter discord-internal teams-internal hipchat flock flowdock pumpchat xmpp ejabberd prosody openfire movim converse jabber sip sip-server voip asterisk freepbx 3cx elastix freeswitch yate kamailio opensips janus mediasoup jitsi jitsi-meet bigbluebutton bbb nextcloud-talk talk meet meeting meetings conference conferences zoom-internal webex-internal gotomeeting gotowebinar fax fax-server # === Storage / file sharing === files file filesharing file-sharing share shares sharepoint sharepoint-internal spo sp nas nas1 nas2 synology synology-nas qnap qnap-nas truenas freenas unraid xpenology nextcloud nextcloud-internal owncloud seafile pydio ajaxplorer filerun projectsend filebrowser filerouter xfiles xfilesharing nexus-public nexusrm artifactory-public public publics download downloads upload uploads ftp ftp-internal ftps sftp sftp-internal ftp-server vsftpd proftpd pureftpd filezilla-server crushftp serv-u servu efs efs-mount nfs nfs-server samba smb cifs ceph cephfs gluster glusterfs moosefs beegfs lustre gpfs spectrum-scale isilon netapp emc purestorage pure storage storage-internal storage-array backup backup-server backups veeam veeam-backup bacula bareos restic borg borgbackup duplicati arq acronis commvault networker netbackup tsm spectrum-protect crashplan backuppc amanda # === Plex / media / NAS apps === plex plex-server jellyfin emby kodi xbmc mediaserver sonarr radarr lidarr readarr prowlarr bazarr ombi overseerr jellyseerr tautulli mylar sabnzbd nzbget deluge qbittorrent transmission rutorrent flood xteve threadfin swag nginx-proxy-manager npm-pm heimdall homer homarr dashy flame # === Mobile / app-specific === m mobile mobile-app mobile-api mobile-internal ios ios-api android android-api app apps app-internal api-mobile mobapi mob appstore playstore fdroid ota ota-server fastlane fastlane-server expo # === API patterns === api api1 api2 api3 apiv1 apiv2 apiv3 api-v1 api-v2 api-v3 api-internal api-private api-admin api-management api-mgmt api-beta api-staging api-prod api-test api-dev api-old api-new api-legacy api-gateway api-gw apigateway gw gateway gateways microservice microservices ms service services svc svcs worker workers queue queues jobs job cron crons scheduler schedulers swagger swagger-ui swaggerui openapi openapi-spec graphql graphiql playground graphql-playground apollo apollo-studio hasura hasura-console postgrest nestjs-api strapi strapi-admin directus directus-admin appwrite appwrite-console supabase supabase-studio parse parseserver parse-dashboard backend4frontend bff gateway-internal ingest ingest-api upload-api download-api events-api webhook webhooks hook hooks callback callbacks # === Common but distinctive prefixes === www www1 www2 www3 ww wwww web web1 web2 web3 webserver webservers ftp1 ftp2 ns ns1 ns2 ns3 ns4 ns5 ns6 ns7 ns8 ns9 nameserver dns dns1 dns2 dns3 dnssec recursor resolver resolvers host1 host2 host3 host4 host5 serv1 serv2 serv3 service1 service2 beta1 beta2 beta3 test4 test5 qa3 qa4 preprod1 preprod2 www-staging www-dev www-test www-qa www-uat www-beta www-internal www-old www-new old older oldsite oldwww new newer newsite newwww legacy legacy-app legacy-api classic classic-www classic-app v1 v2 v3 v4 v5 version1 version2 ver release1 release2 # === Login / signup / account portals === login login-internal logon signin sign-in signup sign-up register registration auth-login account accounts account-internal accounts-internal profile profiles user users users-internal member members membership my myaccount my-account mypage my-page me self preferences settings setting config-ui configurator configure # === Payment / e-commerce === shop store checkout checkout-internal cart basket payment payments pay pay-internal billing-internal invoice invoices invoicing subscription subscriptions plan plans pricing order orders ordering fulfillment shipping shipping-internal return returns refund refunds admin-shop admin-store admin-checkout woocommerce prestashop magento opencart shopify-admin shopify-internal bigcommerce-admin # === DNS / network admin === dhcp dhcp-server radius radius-server freeradius tacacs tacacs-plus proxy proxies proxy-internal forward-proxy reverse-proxy squid squid-internal privoxy trafficserver varnish nginx apache haproxy caddy lighttpd litespeed hitch pound relayd firewall fw fw1 fw2 pfsense opnsense sophos fortigate palo paloalto panorama checkpoint cisco-asa asa juniper srx mikrotik unifi unifi-controller ubiquiti edge edgemax omada aruba ruckus meraki meraki-dashboard ddos ddos-protection shield waf waf-internal cloudflare-internal sucuri modsecurity imperva incapsula akamai fastly azurefront cloudfront-internal netscaler f5 bigip big-ip # === Backup / archive / log === log logs log-server logserver log-aggregator syslog syslog-server syslog-ng rsyslog nxlog journald loki-internal archive archives archiver old-archive historical history audit-log auditlog auditing compliance-log compliance-audit sox pci pci-dss hipaa gdpr dlp dlp-server retention trash recyclebin recycle soft-delete quarantine quarantined # === Misc patterns frequently exposing internal apps === beta-api demo-api test-api qa-api uat-api dev-internal-api internal-services internal-tools tools tool toolbox utility utilities util utils runner runners agent agents worker-internal queue-internal pubsub pub-sub events event event-bus eventbus broker brokers sidecar sidecars controller controllers collector collectors exporter exporters ingester ingesters aggregator aggregators processor processors indexer indexers crawler crawler-internal spider fetcher fetchers scraper scrapers extractor extractors transformer transformers loader loaders normalizer normalizers enricher enrichers classifier classifiers ranker rankers recommender recommenders search search-internal search-api solr elastic-search typesense meilisearch algolia-internal quickwit zoekt sourcegraph opengrok # === BI / data / analytics === analytics analytics-internal ga google-analytics matomo piwik plausible fathom umami mixpanel-internal amplitude-internal segment-internal heap metabase metabase-internal superset apache-superset redash redash-internal looker lookerstudio tableau tableau-server powerbi powerbi-internal qlik qlikview sense mode periscope holistics sigma preset chartio datastudio data-studio data data-internal dataservice data-warehouse dwh edw data-lake datalake lake lakehouse warehouse dbt dbt-cloud dagster prefect airflow airflow-internal luigi oozie azkaban nifi streamsets fivetran stitch hevo airbyte matillion informatica datastage talend pentaho # === Security tools / SOC === soc soc-internal secops secops-internal csirt incident incidents ir forensics forensic hunting threat-intel threatintel ti intel intelligence malware sandbox-malware sandboxing detonator detonation analysis analyst analyst-portal siem siem-internal splunk-soc qradar arcsight sentinel azure-sentinel elastic-siem chronicle sumo-soc log-analytics falcon crowdstrike sentinelone s1 carbonblack cb cybereason fireeye mandiant mcafee-epo epo trendmicro trend sophos-central defender mde mdatp intune edr xdr ndr nta zeek bro suricata snort ossec wazuh wazuh-manager ossim graylog-soc phantom splunk-soar soar demisto xsoar swimlane tines shuffle n8n zapier-internal make-internal ifttt-internal crewai # === Source code / SCM === git git-internal gitea-internal gitlab-internal-srv github-internal github-enterprise ghe src source sources code codes codebase codereview code-review gerrit-review crucible fisheye phabricator-diffusion diffusion review reviews mr merge-request pr pull-request patch patches diff diffs svn svn-server subversion subversion-server mercurial hg hg-server cvs cvs-server fossil-scm git-lfs gitlfs lfs # === IoT / industrial === iot iot-internal iotcore iot-core iot-gateway iot-platform azure-iot aws-iot gcp-iot mqtt-broker hass home-assistant homeassistant openhab domoticz fhem zwave zigbee modbus bacnet scada hmi plc opcua opcserver historian # === ML / AI === ml mlops ai ml-server mlflow mlflow-internal sagemaker sagemaker-studio vertex vertex-ai kubeflow kubeflow-internal ray rayserve seldon seldon-core bentoml bento triton tritonserver tensorflow-serving tfserving torchserve clearml neptune wandb weights-and-biases comet dvc pachyderm domino databricks-internal dbx snorkel polyaxon determined runai # === Blockchain / crypto === node-rpc rpc rpc-internal geth parity besu nethermind erigon prysm lighthouse teku nimbus bitcoind btc-rpc eth-rpc ipfs ipfs-gateway arbitrum-node optimism-node solana-rpc substrate polkadot-node cosmos-node ethereum node nodes-internal # === Scratch / catch-all === xyz abc foo bar baz temp tmp test-only ignore skip private-only nope internal-use-only do-not-use restricted-use hidden secret secret-app hidden-app buried deep deep-link deep-app hidden-portal admin-secret secret-admin backdoor test-page test-server test-site fakepage hello world hello-world ping-pong echo sample samples example examples playground-test sandbox-test scratchpad scratch debug debug-only debug-app debug-server trace-server tracer pprof expvar profiler flamegraph heapdump threaddump diagnostics diag introspect introspection inspect inspector viewer ide vscode codeserver code-server gitpod gitpod-internal coder codercom cloud9 theia eclipse-che che jupyter jupyterhub jupyterlab notebook notebooks zeppelin hue beaker # === Geographic / per-region === us usa us-east us-east-1 us-east-2 us-west us-west-1 us-west-2 eu eu-west eu-west-1 eu-central eu-central-1 eu-north eu-south ap ap-south ap-southeast ap-northeast ap-east asia asia-east asia-west australia oceania americas emea apac latam na eu-east ru russia china cn in india br brazil de germany fr france uk gb britain es spain it italy nl netherlands se sweden no norway fi finland dk denmark pl poland jp japan kr korea sg singapore hk hongkong au australia-east nz # === Functional / micro patterns === www-cdn cdn cdn1 cdn2 cdn-internal edge1 edge2 edge3 node1 node2 node3 host1-internal host2-internal public-cdn static statics static-internal static1 static2 asset assets asset-server img imgs images image image-server img-cdn imgcdn images-internal photo photos pic pics picture pictures gallery galleries media media-server media-internal videos video audio musics music streams stream streaming live livestream broadcast broadcasts podcast podcasts download-cdn files-cdn js javascript script scripts css styles stylesheet fonts font typography i18n intl locale translations translation content contents content-delivery content-internal content-staging content-prod preview-content review-content # === Internal-pattern catch-alls === internal-app internal-app1 internal-app2 internal-portal internal-tool internal-svc intranet-app intranet-portal intranet-tool private-app private-portal private-tool private-svc employee-portal employee-tool staff-portal staff-tool hr-portal hr-tool hr-app finance-portal finance-tool finance-app billing-portal billing-tool billing-app sales-portal sales-tool sales-app marketing-portal marketing-tool marketing-app training training-internal elearning e-learning lms learning learn courses course academy edu education moodle canvas blackboard schoology sakai chamilo ilias opal crowi joplin-server trilium obsidian-publish docs docs-internal documentation docusaurus mkdocs hugo hugo-server jekyll gatsby nextjs next nuxt nuxtjs remix sveltekit astro gridsome eleventy zola hexo # === Typical 3-letter / 4-letter creative === adm api app arc art ave biz biz1 biz2 brd buy cdn chk cks cli cloud1 cloud2 cms crm cog con cpu crm1 ctl ctr cur cvs cyl dat dev1ops dms doc dom dot drive duo dvr ebr eco edi ems end eng esc ess eth exam ext fax fed fin fix flo fop fra ftp3 gas gen geo gis git1 gov gtw gum hex hex1 hub ide1 img1 imp ind ino ins int inv iot1 ipd its jam job ken kit km lab1 lab2 ldp led lib lid lim log1 ltd mag mat md1 mfg mgm mid mig mil mit mn mol mop mou mtv mvc nav ncc nid nim nyc oce ock omg ond opc opt ord ore osc own pad pal pan pat pcr pdf pen pep pet ph phr pia pic1 pin pkg pol pot pre prn prv pub pum quad qua que rad ran rds rec red ref reg rep res rfc rhe rid rmf roa rod rok row rpc1 rsa rtl sad sch sci sct sdk sec sel sem sens ser shi shp sib sig sit sky sli slo smp soc1 sou spa spo sps sql1 ssr sta sti stu sub suc sui svr swt sys tab tag tem ter thr tic tie tim tip tit tks tnt tom tor tox toy tra tre tri trk tsa tt tuc tul tut twn typ ud unc uni upr url1 usf val ven ver1 veg vet vid vif vig vip vir vit vmw vol vor vos vpc1 vpn vps1 vrt vst wax wel wkr wls wmf wob wop wor wp xfr xrt xyz1 yan yes ymp zac zoo zwt