rofl, well I can answer some of this stuff, the whole refer thing can easily be spoofed...as you can see from the list, it HAS been spoofed, really easy. As for the .mil redirects, pentagon.mil resolves to quite a different things if you go to different parts of it, which explains that somewhat.
Here's some stuff on eon8.com
Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2006-06-29 23:37 CDT
Warning: Servicescan failed to fill info_template (subjectlen: 889). Too long? M atch string was line 2473: v/Apache httpd/$1/$2
Interesting ports on f4.f5.1243.static.theplanet.com (67.18.245.244):
(The 1652 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
1/tcp open tcpwrapped
21/tcp open ftp PureFTPd
22/tcp open ssh OpenSSH 3.5p1 (protocol 1.99)
25/tcp open smtp Exim smtpd 4.52
26/tcp open smtp Exim smtpd 4.52
53/tcp open domain ISC Bind 9.2.1
80/tcp open http?
110/tcp open pop3 cppop pop3d 19.0
111/tcp open tcpwrapped
135/tcp filtered msrpc
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
143/tcp open imap UW Imapd 2003.339-cpanel
443/tcp open ssl/http Apache httpd 1.3.33
445/tcp filtered microsoft-ds
465/tcp open ssl/smtp Exim smtpd 4.52
993/tcp open ssl/imap UW Imapd 2003.339-cpanel
995/tcp open ssl/pop3 cppop pop3d 19.0
1720/tcp filtered H.323/Q.931
3306/tcp open mysql MySQL 4.0.27-standard
No exact OS matches for host (If you know what OS is running on it, see http://w ww.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=4.03%P=i686-pc-linux-gnu%D=6/29%Tm=44A4AAB6%O=1%C=2)
TSeq(Class=RI%gcd=1%SI=2ABD99%IPID=Z%TS=U)
TSeq(Class=RI%gcd=1%SI=2B558F%IPID=Z%TS=U)
TSeq(Class=RI%gcd=1%SI=2B439C%IPID=Z%TS=U)
T1(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
Service Info: Host: night.bbhosts.net
and here's their http server info: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.4.0 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
