I remember people on IRC doing something similar to Cloudflare years back. Using a malformed HTTP header to get a servers’ real host IPs. It didn’t give you admin panel access or anything like this does, but you could deanonymize sites.

And to sit on this for 6 years?! I don’t even know what to say about that…