[emmelaich]

Yep, I saw 127.0.0.1 for an A record about 20 years ago.

It was discovered when going to that name outside revealed what seemed to be a copy of our own internal webserver!

What had happened is that our webserver was on the same host as our squid proxy. So we were in fact seeing our own site under the external name.

Protection for this sort of thing is in the default squid conf these days (from memory)

[fulafel]

It was a standard joke to point warez.yourdomain.country to 127.0.0.1 - I wouldn't be surprised if there were still some left and could be used for rebinding attacks!