Worth raising with Optimizely/DXP support as well  - in some DXP tiers you can request that the .episerver.net hostname simply not respond publicly, or enforce canonical hostname validation at the CDN/load balancer layer before it even reaches the app. That would be the cleanest fix and removes the burden from the application entirely.

That said, we can also write a middleware to redirect that traffic based on whether the host header matches the .episerver.net pattern, while passing through anything that looks like an internal or legitimate platform request - we just need to be careful to properly exempt warmup and health check endpoints so we don't break those flows.