What the... a DA easter egg?

T

thoroughfare

Verified User
Joined
Aug 11, 2003
Messages
540
Hi,

I was adding a subdomain for one of my customers, when I was redirected to the website for the band Six Pence None The Richer... very bizarre.

I was adding the subdomain from the front page of the control panel under the User panel.

Cookies/session IDs have been removed to protect the innocent. Here's the HTTP headers:

https://hostname:2222/CMD_SUBDOMAIN



POST /CMD_SUBDOMAIN HTTP/1.1

Host: hostname:2222

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive

Cookie: session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Content-Type: application/x-www-form-urlencoded

Content-Length: 53

action=create&domain=xxxxxxxxx.co.uk&subdomain=test

HTTP/1.x 302 Found

Server: DirectAdmin Daemon v1.24.2 Registered to xxxxxxxxx

Location: https://none

Content-Type: text/html

----------------------------------------------------------

http://www.google.com/search?btnI=I'm+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=none



GET /search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=none HTTP/1.1

Host: www.google.com

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive



HTTP/1.x 302 Found

Transfer-Encoding: chunked

Date: Mon, 23 May 2005 18:32:08 GMT

Content-Type: text/html

Cache-Control: private

Server: GWS/2.1

Content-Encoding: gzip

Location: http://www.sixpence-ntr.com/

----------------------------------------------------------

http://www.sixpence-ntr.com/



GET / HTTP/1.1

Host: www.sixpence-ntr.com

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive



HTTP/1.x 200 OK

Date: Mon, 23 May 2005 18:32:08 GMT

Content-Length: 1346

Content-Type: text/html; charset=UTF-8

Server: Apache/1.3.33 (Unix)

----------------------------------------------------------

http://www.sixpence-ntr.com/favicon.ico



GET /favicon.ico HTTP/1.1

Host: www.sixpence-ntr.com

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive



HTTP/1.x 404 Not Found

Transfer-Encoding: chunked

Date: Mon, 23 May 2005 18:32:09 GMT

Content-Type: text/html; charset=iso-8859-1

Server: Apache/1.3.33 (Unix)

----------------------------------------------------------

http://102.112.2o7.net/b/ss/wmg,wmg...encenonethericher/1/G.0-Xp-S/s46733046828598?[AQB]&ndh=1&t=23/4/2005%2019%3A32%3A9%201%20-60&pageName=Sixpence%20None%20The%20Richer%20-%20home%20page&c5=www.sixpence-ntr.com&g=http%3A//www.sixpence-ntr.com/home_content.html&s=1152x864&c=16&j=1.3&v=N&k=Y&bw=825&bh=688&p=Default%20Plugin%3BJava%28TM%29%20Plug-in%20Blackdown-1.4.2-01%3BShockwave%20Flash%3Bnppdf.so%3B&[AQE]



GET /b/ss/wmg,wmgwbr,wmgsixpence-ntr.com,wmgsixpencenonethericher/1/G.0-Xp-S/s46733046828598?[AQB]&ndh=1&t=23/4/2005%2019%3A32%3A9%201%20-60&pageName=Sixpence%20None%20The%20Richer%20-%20home%20page&c5=www.sixpence-ntr.com&g=http%3A//www.sixpence-ntr.com/home_content.html&s=1152x864&c=16&j=1.3&v=N&k=Y&bw=825&bh=688&p=Default%20Plugin%3BJava%28TM%29%20Plug-in%20Blackdown-1.4.2-01%3BShockwave%20Flash%3Bnppdf.so%3B&[AQE] HTTP/1.1

Host: 102.112.2o7.net

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive


HTTP/1.x 200 OK

Date: Mon, 23 May 2005 18:32:09 GMT

Content-Length: 43

Content-Type: image/gif

Expires: Mon, 23 May 2005 18:32:09 GMT

Cache-Control: no-cache, no-store, must-revalidate, max-age=0

Server: Apache/1.3.26 (Unix) mod_ssl/2.8.10 OpenSSL/0.9.6e

X-C: ms-1.1

Last-Modified: Tue, 24 May 2005 18:32:09 GMT

Pragma: no-cache

Etag: 429221A9-2FE3-16B5744D

Vary: *

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"

xserver: www195

----------------------------------------------------------

http://www.sixpence-ntr.com/favicon.ico



GET /favicon.ico HTTP/1.1

Host: www.sixpence-ntr.com

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive




HTTP/1.x 404 Not Found

Transfer-Encoding: chunked

Date: Mon, 23 May 2005 18:32:10 GMT

Content-Type: text/html; charset=iso-8859-1

Server: Apache/1.3.33 (Unix)

----------------------------------------------------------

http://102.112.2o7.net/b/ss/wmg,wmg...pencenonethericher/1/G.0-Xp-S/s4131523262425?[AQB]&ndh=1&t=23/4/2005%2019%3A32%3A23%201%20-60&pageName=Sixpence%20None%20The%20Richer%20-%20home%20page&c5=www.sixpence-ntr.com&g=http%3A//www.sixpence-ntr.com/home_content.html&s=1152x864&c=16&j=1.3&v=N&k=Y&bw=825&bh=688&p=Default%20Plugin%3BJava%28TM%29%20Plug-in%20Blackdown-1.4.2-01%3BShockwave%20Flash%3Bnppdf.so%3B&[AQE]



GET /b/ss/wmg,wmgwbr,wmgsixpence-ntr.com,wmgsixpencenonethericher/1/G.0-Xp-S/s4131523262425?[AQB]&ndh=1&t=23/4/2005%2019%3A32%3A23%201%20-60&pageName=Sixpence%20None%20The%20Richer%20-%20home%20page&c5=www.sixpence-ntr.com&g=http%3A//www.sixpence-ntr.com/home_content.html&s=1152x864&c=16&j=1.3&v=N&k=Y&bw=825&bh=688&p=Default%20Plugin%3BJava%28TM%29%20Plug-in%20Blackdown-1.4.2-01%3BShockwave%20Flash%3Bnppdf.so%3B&[AQE] HTTP/1.1

Host: 102.112.2o7.net

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive


HTTP/1.x 200 OK

Date: Mon, 23 May 2005 18:32:23 GMT

Content-Length: 43

Content-Type: image/gif

Expires: Mon, 23 May 2005 18:32:23 GMT

Cache-Control: no-cache, no-store, must-revalidate, max-age=0

Server: Apache/1.3.26 (Unix) mod_ssl/2.8.10 OpenSSL/0.9.6e

X-C: ms-1.1

Last-Modified: Tue, 24 May 2005 18:32:23 GMT

Pragma: no-cache

Etag: 429221B7-24DE-5B83CEC3

Vary: *

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"

xserver: www372

----------------------------------------------------------

http://www.sixpence-ntr.com/favicon.ico



GET /favicon.ico HTTP/1.1

Host: www.sixpence-ntr.com

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4

Accept: image/png,*/*;q=0.5

Accept-Language: en

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive



HTTP/1.x 404 Not Found

Transfer-Encoding: chunked

Date: Mon, 23 May 2005 18:32:23 GMT

Content-Type: text/html; charset=iso-8859-1

Server: Apache/1.3.33 (Unix)

----------------------------------------------------------
Click to expand...

Sooo bizarre.
Matt
 
I did not read through the headers, but are you sure that Directadmin forwarded to that location and not another program executing the default browser to a location at the same time?
Can you reproduce the results when adding another subdomain in the same manner?
 
You must log in or register to reply here.
Back
Top