I use subdomains and a wildcard cert to partly obfuscate this.