@Alice @blockbot @p @ins0mniak @85f02109a28864e4713d3f972ab66a I don't know how exactly (was just replicating responses of a bugged friendica instance that was reporting IP in private range as its hostname), but this triggered a bug in webfinger rewrite that neglected to check that actual hostname. Gleason alluded to that and had it fixed in rebased months ago.