When internal hostnames are leaked to the clown