title: My EC2 instance receives traffic for unrelated hostnames. How does this happen?
body: <p>I have a couple EC2 instances behind an Elastic Load Balancer.  These instances serve HTTP requests for a single web site.  I recently started looking at the HOST header of the traffic, because I am planning to split my app into virtual hosts.</p>
  
  <p>With some regularity (dozens of times a day), I log a request for a host name that is totally unrelated to my servers.  As a couple examples, today I saw requests with the host names <code>ad.adserverplus.com</code> and <code>r1---sn-upfn-hp5e.c.youtube.com</code>.  I looked these up and the IP addresses are not the same as any of my servers, nor of the ELB, so I am trying to develop a theory as to how this happens.</p>
  
  <p>I realize that someone could be spoofing the host header, but it happens often enough that I am pretty sure this is not what is going on.  My other idea is that somehow there is stale DNS data that just happens to resolve one of those hosts to my IP address, but again this seems like it could happen once in a great while but not regularly.  What are some other possibilities, and how might I verify / discredit them?</p>
  
  <p>EDIT
  I looked at some of the unexpected host names today, and it seems that they actually <em>do</em> resolve to an IP that is one of the possible IPs that my domain apex resolves to.  I use Route 53 for DNS, and I have the zone apex pointed to the ELB, so when I query the IP address for my domain, I get different answers depending on when I ask.  So this makes me very curious, how do these IP addresses get assigned to me and how does EC2 make sure they are not co-opting an IP address that someone else is already using.</p>