Login
You're viewing the attractive.space public feed.
  • Elias Mårtensonloke@functional.cafe
    Sep 27, 2026, 1:45 PM

    Because of this, I took a closer look at my access logs. Indeed, they are much more clean now, but I see this really strange thing.

    This is from the nginx access log for kap-lang.org/ (as well as the alternative name: kapdemo.dhsdevelopments.com/)

    92.209.236.167 - - [27/Sep/2026:13:34:00 +0000] "GET / HTTP/1.1" 200 1168 "https://blog.dhsdevelopments.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0"

    The interesting thing is that blog.dhsdevelopments.com is just a CNAME to me.writeas.com. So why does this request show up here? Some kind of bot that is testing things? It certainly can't be a normal web browser, could it?

    💬 2🔄 1⭐ 0

Replies

  • Elias Mårtensonloke@functional.cafe
    Sep 27, 2026, 1:49 PM

    Wow... After making that post, I sure got a lot of page requests from Mastodon servers. I'm glad those were not filtered by anubis.

    💬 0🔄 0⭐ 0
  • Athena L.M.alilly@solarpunk.moe
    Sep 27, 2026, 1:48 PM

    @loke CNAMEs are processed within the DNS resolution infrastructure and behave as entirely separate hosts at the application layer.

    💬 0🔄 0⭐ 0
  • Athena L.M.alilly@solarpunk.moe
    Sep 27, 2026, 1:50 PM

    @loke If you want HTTP clients to request Host: a.example instead of b.example you need to return an HTTP redirect to requests for b.example.

    💬 0🔄 0⭐ 0
  • Elias Mårtensonloke@functional.cafe
    Sep 27, 2026, 2:14 PM

    @alilly Indeed, that's how DNS and virtual hosts works. The weird thing here is that this server does not serve, and has never served, anything relating to blog.dhsdevelopments.com. So I should never see a request to fetch anything from that host.

    In fact, the only thing that this server has in common with blog.dhsdevelopments.com is that it serves a couple of other sites under dhsdevelopments.com.

    Now, my best hypothesis right now is that some scraper that knows how to get past anubis saw content.blog.dhsdevelopments.com (which is served by this server) and then tried something on this domain.

    💬 0🔄 0⭐ 0