Setting `Host` to other known or guessed domains may give **different responses**.
curl -H "Host: admin.example.com" http://10.10.10.10/Common indicators that you're hitting a different VHOST: * Different HTML titles, meta descriptions, or brand names * Different HTTP Content-Length / body size * Different status codes (200 vs. 403 or redirect) * Custom error pages * Redirect chains to completely different domains * Certificates with Subject Alternative Names listing other domains **NOTE**: Leverage DNS history records to identify old IP addresses previously associated with your target’s domains. Then test (or "spray") the current domain names against those IPs. If successful, this can reveal the server’s real address, allowing you to bypass protections like Cloudflare or other WAFs by interacting directly with the origin server.
Source: Virtual Hosts/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.