Hacker News Reader

The domain owner should care, because OP could misuse the domain.

Right, the domain owner should care. Not OP.

But OP does care about others. If you own a domain it's a non-obvious vulnerability.

Thanks OP!

Totally agree. I failed to add server_name to my nginx config. IIRC I wrongly assumed that it can only accept one domain/pattern and didn't want to bother so I can simplify testing using localhost.

I think the concern is for the domain owner who could get a visit from the government if “their” server is serving something illegal.