Traffic being directed at random infrastructure with pornhub.com host header (?)

Wed Sep 13 14:28:07 UTC 2023

On Wed, 13 Sep 2023 13:35:30 +0000
Drew Weaver <drew.weaver at thenap.com> wrote:

> Has anyone else recently seen a spike of port 80 traffic being sent
> at seemingly random IP addresses that include the Pornhub host header?

Yes.  The source possible, hopefully being research or commercial
scanners perhaps?  I've seen a host from a US midwest EDU source
doing this. User agent string in that case was "Mozilla/5.0 quack/1.x"

It may be some sort of censorship measurement or perhaps even something
like this type of work:

  <https://www.usenix.org/conference/usenixsecurity21/presentation/bock>

John