Hey, that's not my server!

This Censys report explains that CDNs and transparent proxies can serve legitimate TLS certificates on bare IP addresses when clients send a null SNI, allowing unrelated hosts to appear legitimate. The author demonstrates how an attacker or misconfigured proxy can forward traffic to CDN infrastructure (preserving TLS handshakes) and documents an analysis searching Akamai certificates on non-Akamai hosts, finding roughly 7,000 instances of 1:1 proxying—behavior that can be a benign quirk of the Internet or a tactic used to mask malicious infrastructure.