These aren't just confluence honeypots though. They serve multiple combinations of headers as I described in my other comment[1], so that they can catch the most amount of attackers.

[1] https://news.ycombinator.com/item?id=39232102