@alilly Indeed, that's how DNS and virtual hosts works. The weird thing here is that this server does not serve, and has never served, anything relating to blog.dhsdevelopments.com. So I should never see a request to fetch anything from that host.

In fact, the only thing that this server has in common with blog.dhsdevelopments.com is that it serves a couple of other sites under dhsdevelopments.com.

Now, my best hypothesis right now is that some scraper that knows how to get past anubis saw content.blog.dhsdevelopments.com (which is served by this server) and then tried something on this domain.