aaPanel_Captain Thanks for your reply.
Yes, for e.g. https://www-.jophi.cc loads the web, but global variables like
$_SERVER['HOST'] are empty. If there are further issues caused by this, or if aaPanel's functionality is directly affected by this, I cannot figure it out, but I'm afraid that it could be.
Most of are afraid of manipulated query strings. Now I'm afraid of manipulated host-/domain names.
I currently deny this type of requests manually. No server should accept illegal naming. I'm just afraid that this could be abused. As I know, it's not allowed to use a subdomain starting or ending with a "-". There are further rules, I haven't tested yet.
I was not sure where I can/could/should report it. I decided for this forum, because I think that it's the best place for it. Devs/Users on one place. If it's a bug of aaPanel, it could be solved. If it's a bug in Apache2, devs of aaPanel could report it.
I'm also not able to say that this phenomenon is exclusively bounded to aaPanel. I also can just talk in combination to Apache2. I'm in lack of other options where I'm able to test it.
Greetings from Austria,